Looking Back to Look Forward: The Anthem Breach

Part 2 of 2

security-breachIn Part 1 of this discussion of threat actor analysis, we got some insights into why threat actor analysis has a major role to play in every phase of cybersecurity, from prevention to mitigation to response to monitoring. Today, we’ll take a look at how a key DomainTools partner, ThreatConnect, used DomainTools and other data to develop a very comprehensive profile—and quite possibly the exact identity—of the actors behind one of the largest data breaches ever known, that of Anthem Healthcare, with personal data on some 80 million people released. While the Anthem breach isn’t the latest major healthcare breach (Premera holds that dubious distinction, for now, at least), it does shed light on how adversary profiling works. Incidentally, the Anthem article almost spookily presages the Premera breach, with discovery of some illegitimate Premera-themed domains.

Attribution

Whodunit? Most of the suspicion lies on China, with strong connectors in the attack infrastructure pointing to operatives there. Even more specifically, a professor at Southeast University in Nanjing (with ties to a cybersecurity company) may ultimately have masterminded the attack, and may have used students to carry it out as part of a competition. As we saw in Part 1, understanding the adversary can pay off in many different ways, from enhanced forensics to strengthened proactive defenses.

From Attack to Attacker

How did ThreatConnect use domain profile information to ultimately achieve a high-confidence attribution for this attack? The ThreatConnect article explains it in detail, but here we’ll look at a high-level summary of the steps:

  • The initial attack domain identified by ThreatConnect (we11point[.]com, a “typo” variant of Anthem’s former name, Wellpoint) was found through malware analysis. This malware had been seen in other Chinese APT attacks; this helped point the attribution analysis toward China, though this was far from conclusive at this early stage.
  • The malware and a digital signature associated with it had been connected to an earlier attack, and that earlier attack involved an IP address, 192.199.254[.]126, which hosted the domain topsec2014[.]com–another clue. That domain, in turn, yielded a registrant email address of li2384826402@yahoo[.]com. Whois History on the domain, however, also shows another email address, TopSec_2014@163[.]com. The TopSec domain and email addresses are strong connectors to the Topsec security company–yet another link in the chain of attribution.
  • Timing is everything. The registration of topsec2014[.]com, in May of 2014, coincides closely with the TopSec Cup competition. When looking at domains that may or may not be connected, registration dates can be instructive. In the presence of other corroborating information, correlated dates can help solidify connections between domains.
  • Obfuscation techniques can aid attackers, but can also aid researchers. Infrastructure connected to both the Anthem attack and an earlier spearphishing attempt on defense contractor VAE, was registered using phony names based on Iron Man superhero characters, something we’ve noted before. While this practice may obscure the actual name of the registrant, it does provide a strong connector for researchers piecing together criminal infrastructure maps.
  • Search engines are your friends. The connection to Nanjing Southeast University and a specific professor was shown (strongly, if not conclusively) in search engine results on the topsec_2014@163[.]com email address. While the actual search results came back for topsec2014@163[.]com (no underscore), the similarity of the addresses proved very unlikely to be coincidental. The search results pointed to a professor at the university with extensive experience in cybersecurity and—as further research turned up—cyberattacks.
Datapoint Type How Discovered
we11point[.]com Malware C2 Malware analysis
192.199.254[.]126 C2 hosting infrastructure Malware analysis
topsec2014[.]com Malware C2 DNS/hosting
li2384826402@yahoo[.]com initial registrant of topsec2014[.]com Whois History
TopSec_2014@163[.]com later (current) registrant of topsec2014[.]com Whois
Iron Man-themed email addresses Whois contact information Whois

Ultimately, with the help of a security outfit called Defense Group, Inc, ThreatConnect was able to make a very strong case a) attributing the breach to this professor, and b) establishing a very likely tie to the government, specifically the People’s Liberation Army (PLA).

Takeaways

There are several important points illustrated by the investigation of the Anthem breach that you can put into practice any time:

  • Guard against typo or other “squatter” violations of your organization’s domain(s). While at first blush this may seem to be principally a brand protection measure, we are seeing a lot of attack infrastructure that makes use of imitative or illicitly-registered domain names that are related to the victim organization’s domains. Use Domain Search to look up registrations that include your organization’s name. Are they all legitimate? Use Domain Typo Finder to find variants of your organization’s name that may have been illicitly registered. Some organizations defensively register such domains.
  • If you spot malicious or suspicious activities (such as phishing attempts or devices on your network calling out to possible C2 infrastructure), use DomainTools Reverse Tools and History Tools to find related infrastructure. Look for the expanded sets of domains and/or IP addresses in your current as well as archived logs. It could be that traffic that escaped notice in the past was part of an attack.
  • If you identify malicious infrastructure that has been attacking you—or even just “knocking at the door”—set up monitors to be alerted to expansions of this infrastructure as they come online.

Looking back at an attempted or successful cyberattack can yield plenty of valuable information for the present and the future. Try some of the techniques suggested here, and fine-tune your investigative skills so that, should the unthinkable happen, you’re prepared to respond quickly and effectively.

Be safe out there!

Share


Leave a Reply

Your email address will not be published. Required fields are marked *

  • Quote of the Day

    Faith risks failure rather than not trying at all.
    -Peter G. James Sinclair
    Famous Quotes Courtesy of iQuotesFamous.com
  • Sponsor