CISA Alert AA22-277A – Impacket and exfiltration tool used to steal sensitive information from defense industrial base organization.

From November 2021 through January 2022, the CISA responded to APT activity against a Defense Industrial Base organization’s enterprise network. During incident response activities, CISA discovered that multiple APT groups compromised the organization’s network, and some APT actors had long-term access to the environment. APT actors used an open-source toolkit called Impacket to gain their foothold within the environment and further compromise the network, and also used a custom data exfiltration tool, CovalentStealer, to steal the victim’s sensitive data.
AA22-277A …

access alert apt base cisa cisa alert compromised defense defense industrial base enterprise exfiltration impacket incident incident response industrial information january network november organization response sensitive information steal tool