Kaspersky ICS CERT experts helped a Russian software developer neutralize a multi-month cyberattack. The company initially detected suspicious activity involving unauthorized account access to system administrator computers.
The attackers, identified as the BO Team, compromised critical infrastructure, including mail servers, backup systems, network hardware, hypervisors, and domain controllers. They gained access to source code repositories and build signing servers, creating a risk of malicious code injection into software distributions.
To remain undetected, the group minimized malware usage, relying on system utilities, file masking, and log deletion. Despite initial remediation, the attackers attempted to regain access by sending phishing emails using a stolen DKIM key, which was subsequently identified and blocked.
Kaspersky experts utilized simulated infrastructure test benches to monitor the attackers' methods. The company recommends implementing EDR and SIEM solutions, maintaining updated software, using multi-factor authentication, and conducting regular security awareness training.
