Dark Red Team (DaRT)

Mission “Know your Enemy”

The Dark Red Team (DaRT) will emulate the actions of known Advanced Persistent Threat (APT) groups with the intention of revealing exploitable weaknesses in defenses. Sophisticated and well-resourced threat actors operate over an extended periods of time with specific objectives. While the objectives of known APT groups can vary depending on their motives and affiliations, some common types of objectives they focus on include:

  1. Intellectual Property Theft: APT groups often target organizations to steal valuable intellectual property, trade secrets, research and development data, or proprietary information. This stolen data can provide them with a competitive advantage or be sold to interested parties.
  2. Espionage and State-Sponsored Activities: Some APT groups are associated with nation-states and engage in cyber espionage to gather intelligence on political, economic, or military targets. Their objectives can include accessing classified information, monitoring diplomatic communications, or disrupting the operations of rival nations.
  3. Financial Gain: APT groups may target financial institutions, payment processors, or retail organizations to carry out financially motivated attacks. Their objectives can include stealing financial credentials, conducting fraudulent transactions, or compromising systems for monetary gain.
  4. Disruption or Sabotage: Certain APT groups aim to disrupt the operations of specific organizations, critical infrastructure, or governmental entities. Their objectives can involve causing disruptions, service outages, or sabotaging key systems, potentially with political or ideological motivations.
  5. Cyber Warfare: APT groups associated with nation-states may engage in cyber warfare, seeking to compromise the infrastructure, communication networks, or military systems of adversaries. Their objectives can include gaining access to military plans, disrupting military operations, or engaging in information warfare.
  6. Targeted Surveillance and Reconnaissance: APT groups conduct targeted surveillance to gather information on specific individuals, organizations, or government entities. Their objectives can include monitoring communication channels, tracking individuals, or mapping out organizational structures for future exploitation.
  7. Influence Operations: APT groups may engage in influence operations to shape public opinion, spread disinformation, or conduct social engineering campaigns. Their objectives can involve manipulating public sentiment, swaying elections, or undermining trust in institutions.

It’s important to note that the objectives of APT groups can evolve over time, and they may adopt multiple objectives simultaneously. These groups employ sophisticated techniques, including social engineering, zero-day exploits, and long-term persistence, to achieve their goals while remaining undetected for extended periods.

Organizations must stay vigilant, adopt robust security measures, and actively monitor for signs of APT activity to mitigate the risks posed by these persistent and determined threat actors. SOC 288 provides the services to defend organizations against APT style attacks. The DaRT acts as an APT group attempting to locate exploitable weaknesses in SOC 288 defenses. This constant feedback loop between the SOC and the DaRT creates an ever evolving and improving defensive posture.

DaRT Actions

There are many phases of an engagement with the target. If a target is lightly defended, only a few phases will be necessary. Organizations that take security more seriously and are willing to invest in time, training, and resources on their blue team are going to require more work.

  1. Recon (gather priority intelligence requirements)
  2. Mission Support (logistics and infrastructure)
  3. Initial Access (aka Foothold)
  4. DaRT DZ (like an Airborne Dropzone, vulnerable to early SOC actions)
  5. Patrol Base (gain persistence)
  6. Establish commo (Command and Control)
  7. Lay of the Land (Where am I, what’s around me?)
  8. Sneakin’ and Peekin'(looking for more creds)
  9. Tip toe thru the minefield (SOC evasion)
  10. Door to Door (lateral movement thru the neighborhood)
  11. Gain the high ground (privilege escalation)
  12. Eyes on the price (target located)
  13. Going Loud!! (expend all ammunition, burn everything in place, exfil)
  14. Get to the chopper! (exfiltration with the target)

Atomic Red Team – git repo

Recon Checklist