This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have observed persistent continued cyber intrusions by advanced persistent threat (APT) actors targeting U.S. think tanks. This malicious activity is often, but not exclusively, directed at individuals and organizations that focus on international affairs or national security policy.[1] The following guidance may assist U.S. think tanks in developing network defense procedures to prevent or rapidly detect these attacks.

APT actors have relied on multiple avenues for initial access. These have included low-effort capabilities such as spearphishing emails and third-party message services directed at both corporate and personal accounts, as well as exploiting vulnerable web-facing devices and remote connection capabilities. Increased telework during the COVID-19 pandemic has expanded workforce reliance on remote connectivity, affording malicious actors more opportunities to exploit those connections and to blend in with increased traffic. Attackers may leverage virtual private networks (VPNs) and other remote work tools to gain initial access or persistence on a victim’s network. When successful, these low-effort, high-reward approaches allow threat actors to steal sensitive information, acquire user credentials, and gain persistent access to victim networks.

Given the importance that think tanks can have in shaping U.S. policy, CISA and FBI urge individuals and organizations in the international affairs and national security sectors to immediately adopt a heightened state of awareness and implement the critical steps listed in the Mitigations section of this Advisory.

Click here for a PDF version of this report.

CISA and FBI recommend think tank organizations apply the following critical practices to strengthen their security posture.

Leaders

• Implement a training program to familiarize users with identifying social engineering techniques and phishing emails.

Users/Staff

• Log off remote connections when not in use.
• Be vigilant against tailored spearphishing attacks targeting corporate and personal accounts (including both email and social media accounts).
• Use different passwords for corporate and personal accounts.
• Install antivirus software on personal devices to automatically scan and quarantine suspicious files.
• Employ strong multi-factor authentication for personal accounts, if available.
• Exercise caution when:
  • Opening email attachments, even if the attachment is expected and the sender appears to be known. See Using Caution with Email Attachments.
  • Using removable media (e.g., USB thumb drives, external drives, CDs).

IT Staff/Cybersecurity Personnel

• Segment and segregate networks and functions.
• Change the default username and password of applications and appliances.
• Employ strong multi-factor authentication for corporate accounts.
• Deploy antivirus software on organizational devices to automatically scan and quarantine suspicious files.
• Apply encryption to data at rest and data in transit.
• Use email security appliances to scan and remove malicious email attachments or links.
• Monitor key internal security tools and identify anomalous behavior. Flag any known indicators of compromise or threat actor behaviors for immediate response.
• Organizations can implement mitigations of varying complexity and restrictiveness to reduce the risk posed by threat actors who use Tor (The Onion Router) to carry out malicious activities. See the CISA-FBI Joint Cybersecurity Advisory on Defending Against Malicious Cyber Activity Originating from Tor for mitigation options and additional information.
• Prevent exploitation of known software vulnerabilities by routinely applying software patches and upgrades. Foreign cyber threat actors continue to exploit publicly known—and often dated—software vulnerabilities against broad target sets, including public and private sector organizations. If these vulnerabilities are left unpatched, exploitation often requires few resources and provides threat actors with easy access to victim networks. Review CISA and FBI’s Top 10 Routinely Exploited Vulnerabilities and other CISA alerts that identify vulnerabilities exploited by foreign attackers.
• Implement an antivirus program and a formalized patch management process.
• Block certain websites and email attachments commonly associated with malware (e.g., .scr, .pif, .cpl, .dll, .exe).
• Block email attachments that cannot be scanned by antivirus software (e.g., .zip files).
• Implement Group Policy Object and firewall rules.
• Implement filters at the email gateway and block suspicious IP addresses at the firewall.
• Routinely audit domain and local accounts as well as their permission levels to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account.
• Follow best practices for design and administration of the network to limit privileged account use across administrative tiers.
• Implement a Domain-Based Message Authentication, Reporting & Conformance (DMARC) validation system.
• Disable or block unnecessary remote services.
• Limit access to remote services through centrally managed concentrators.
• Deny direct remote access to internal systems or resources by using network proxies, gateways, and firewalls.
• Limit unnecessary lateral communications.
• Disable file and printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Ensure applications do not store sensitive data or credentials insecurely.
• Enable a firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious email attachments; ensure any scanned attachment is its “true file type” (i.e., the extension matches the file header).
• Monitor users’ web browsing habits; restrict access to suspicious or risky sites. Contact law enforcement or CISA immediately regarding any unauthorized network access identified.
• Visit the MITRE ATT&CK techniques and tactics pages linked in the ATT&CK Profile section above for additional mitigation and detection strategies for this malicious activity targeting think tanks.