TTP Tuesday: APT29 - RNC Hack

3rd party mischief

Theme Overview

This week we are releasing our last APT29 themed chain based on the RNC hack in 2021. ESET has identified and attributed the attack to APT29. Like our previous case studies, not much information about this attack has been released.

Utilize me: Third party tools

This week's kill chain focused on APT29’s utilization of 3rd party software. APT29 used AdFind, an Active Directory query tool, in order to collect information about compromised networks. They’ve also extensively utilized Dropbox as a means upload results of reconnaissance. To model these behaviors, we created our latest chain, ExBox. This chain executes AdFind to collect information, compresses these results, and exfiltrates these results to Dropbox.

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu 
Reddit: https://www.reddit.com/r/preludeorg/ 
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg 
Read our blog: https://feed.prelude.org  
Watch our live streams: https://www.twitch.tv/preludeorg 
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: https://twitter.com/privateducky 
Alex: https://twitter.com/khyberspache 
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Sam: https://twitter.com/wasupwithuman