Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as “GruesomeLarch” (also known as APT28, Fancy Bear, or Forest Blizzard), has unveiled a novel attack technique dubbed the “Nearest Neighbor Attack.”

Leveraging compromised Wi-Fi networks close to their intended victim, the group orchestrated a sophisticated breach that highlighted a new frontier in cyber warfare.

This attack was meticulously documented by Volexity, a cybersecurity firm, during an investigation tied to heightened tensions leading up to Russia’s invasion of Ukraine in early 2022.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

The Nearest Neighbor Attacks

The Nearest Neighbor Attack is a groundbreaking cyber-espionage method where attackers exploit Wi-Fi networks of organizations geographically adjacent to their target.

In this case, GruesomeLarch targeted “Organization A,” an entity involved in Ukraine-related projects, by first breaching nearby organizations to gain lateral access. Here’s how the attack unfolded:

Credential Compromise: The attackers began by conducting password-spraying attacks on Organization A’s internet-facing services. While multi-factor authentication (MFA) protected most systems, the enterprise Wi-Fi network relied solely on valid domain credentials, providing a critical vulnerability.

Exploiting Nearby Networks: Unable to connect directly to Organization A’s Wi-Fi network from afar, the attackers compromised multiple organizations in close physical proximity. They identified dual-homed systems computers connected to both wired and wireless networks—within these neighboring organizations.

Wi-Fi Access and Lateral Movement: The attackers authenticated to Organization A’s Wi-Fi network using dual-homed systems as a bridge. This allowed them to infiltrate Organization A’s internal systems without deploying malware, relying instead on legitimate credentials and living-off-the-land techniques to evade detection.

Data Exfiltration and Persistence: The attackers staged sensitive data for exfiltration and covered their tracks using native Windows tools like Cipher.exe to securely delete evidence. They also abused advanced tactics like dumping Active Directory databases via shadow copies to extract credentials.

Volexity’s investigation into the breach began in February 2022, just before Russia’s invasion of Ukraine. An alert from a custom detection signature revealed suspicious activity on Organization A’s network. What followed was a month-and-a-half-long probe that unraveled the novel attack vector.

Initially, investigators faced several dead ends. The attackers had meticulously erased traces of their activity, leveraging anti-forensic techniques such as secure file deletion and advanced tunneling methods.

However, a breakthrough came when Volexity accessed Organization A’s wireless controller logs. These logs revealed that the attacker’s device was connecting to access points near a conference room adjacent to street-facing windows. Yet, it was eventually discovered that the attacker was not physically present but operating from a compromised system in a neighboring building.

Further analysis revealed that GruesomeLarch had breached not only Organization B, located across the street, but also Organization C, another nearby entity.

The attackers maintained a persistent foothold in their target’s network by daisy-chaining access through these organizations.

Over a month after the first attack was stopped, the same hackers were spotted again, this time using Organization A’s guest Wi-Fi network.

They found a system that was set up incorrectly, giving it access to both the guest Wi-Fi and the company’s main network, allowing them to sneak back into the important corporate systems and showing how determined they were while highlighting the need to secure every part of the network.

The attack was ultimately attributed to GruesomeLarch, a Russian APT group, after files and techniques observed during the investigation matched those described in Microsoft’s April 2024 report on “Forest Blizzard.”

The group utilized a post-compromise tool called GooseEgg, which was employed to exploit a zero-day vulnerability in the Microsoft Windows Print Spooler service (CVE-2022-38028). This discovery solidified GruesomeLarch’s involvement and demonstrated their advanced capabilities.

Key Lessons and Mitigation Strategies

Volexity’s investigation underscores the need for organizations to reassess how they secure their Wi-Fi networks. Key recommendations include:

• Enhance Wi-Fi Security: Apply MFA or certificate-based authentication for enterprise Wi-Fi networks, similar to VPN protections.
• Network Segmentation: Separate Wi-Fi and Ethernet-wired networks, particularly for systems accessing sensitive resources.
• Monitor Native Tools: Detect anomalous use of tools like Cipher.exe and netsh for potential malicious activity.
• Improve Logging: Ensure detailed logging for wireless controllers, DHCP servers, and web services to aid in investigations.
• Harden Guest Networks: Fully isolate guest Wi-Fi from corporate networks and regularly audit configurations.
• Custom Detection Rules: Create alerts for unusual file executions from non-standard directories, such as C:\ProgramData\.

Are you from SOC/DFIR Teams? – Analyse Malware & Phishing with ANY.RUN -> Try for Free