Micah Lee 🫡

@micahflee ↗

Deleted No

Hibernated No

Last Checked Jan. 10, 2021

Created

Tue Dec 22 20:57:50 +0000 2020

Likes

Retweets

Source

Twitter Web App

View Raw Data

JSON Data

View on Twitter

Likely Available

Micah Lee 🫡 @micahflee

While connected to the VPN, they then, for example, can use legit creds to login to anyone's Office 365 email account (CISA says they were observed doing this). Basically, they can login to anything on the entire network and could place backdoors anywhere — PolitiTweet.org

Posted Dec. 22, 2020

Preceded By

Micah Lee 🫡 @micahflee

Berserk Bear's campaign works like this: - Hackers get a foothold in target network by exploiting a VPN - Once in, they use CVE-2020-1472, a brutal Netlogon vuln that takes over Active Directory - Once AD is owned, they extract legit credentials for anyone on the network — PolitiTweet.org

Posted Dec. 22, 2020 Hibernated

Followed By

Micah Lee 🫡 @micahflee

The only way to be sure you have cleaned up this hack is to, essentially, burn down the entire network and start over from scratch, and while you're at it reset every single password. Here's some of CISA/FBI's advise on mitigating it: https://t.co/H0YkGcEspQ — PolitiTweet.org

Posted Dec. 22, 2020