The National Cybersecurity and Communications Integration Center issued a technical alert in response to multiple reports of advanced persistent threat actors actively exploiting trust relationships in information technology service provider networks.

Since May 2016, APT actors have used various tactics, techniques, and procedures for cyberespionage and intellectual property theft worldwide. APT actors have targeted victims in several U.S. critical infrastructure sectors, including IT, energy, healthcare and public health, communications, and critical manufacturing.

A successful network intrusion can have severe effects on the affected organization, particularly if the compromise becomes public. They include:

• Temporary or permanent loss of sensitive or proprietary information.
• Disruption to regular operations.
• Financial losses to restore systems and files.
• Potential harm to the organization's reputation.

The NCCIC said potential targets include parent companies, connected partners, and contracted managed service providers and cloud serviced providers. APT actors can leverage legitimate credentials to expand unauthorized access, maintain persistence, exfiltrate data, and conduct other operations under the pretext of authorized activity. Leveraging legitimate credentials also allows APT actors to access other devices and trusted networks, enabling them to maintain persistence and obfuscate detection tools.