TA410

Executive Summary

TA410 is suspected state-sponsored threat actor targeting US utilities through sophisticated phishing campaigns. Their primary tactic involves spear-phishing emails with malicious Microsoft Word attachments that deploy custom malware to compromise critical infrastructure sectors.

Goals & Targeting

TA410 appears to target the US utilities sector strategically, potentially aiming to disrupt or gain unauthorized access to critical infrastructure. Their choice of victims suggests a focus on industries that could pose significant risks to national security if compromised. The use of state-sponsored tactics indicates a likely intent to gather intelligence or execute disruptive activities.

TA410, also referred to as a state-sponsored actor, has demonstrated significant focus on the US utilities sector. In August 2019, Proofpoint identified TA410's activity through a campaign dubbed 'Lookback,' which used spear-phishing emails to target multiple US companies in the utilities sector. The phishing emails were crafted to appear as official communications from Global Energy Certification (GEC), leveraging the domain globalenergycertification.net. These emails contained malicious Microsoft Word documents with宏(hé) malware, designed to execute Lookback on compromised systems. TA410's ability to impersonate legitimate entities and remain undetected for extended periods highlights their sophistication in targeting critical infrastructure.

Key Capabilities

• Spear-phishing campaigns using fake domains and legitimate-sounding emails
• Delivery of malicious Microsoft Word documents with embedded macros
• Deployment of Lookback malware for potential persistence or data theft
• Ability to target critical infrastructure sectors
• State-sponsored operational capabilities

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

TA410's campaign in August 2019 demonstrated a persistent and targeted approach, indicating a possible long-term operational strategy. The use of a specific domain (globalenergycertification.net) to impersonate GEC suggests careful planning and a focus on credibility. This actor’s targeting patterns and techniques align with state-sponsored activity aiming to compromise critical infrastructure.

IOC Patterns

• Spear-phishing emails originating from domains mimicking legitimate certification bodies
• Malicious Microsoft Word attachments containing macros
• Lookback malware detection
• Email headers originating from .net domains

Recommended Actions

• Enhance email filtering to detect and block spear-phishing attempts
• Conduct employee training on identifying phishing emails
• Monitor for malicious document downloads and macro activity
• Implement network monitoring to detect Lookback malware indicators
• Secure industrial control systems (ICS) against potentialattacks

Suggested Tags