Since the beginning of 2024, FedRAMP Revision 5 has mandated that organizations not only perform traditional penetration tests, but also undergo comprehensive red team engagements. This new requirement reflects a broader emphasis on assessing not just technical vulnerabilities, but also the effectiveness of an organization’s overall security posture, including it’s response to sophisticated and realistic threats. Over the past year, we’ve conducted many red team exercises, each tailored to different organizational environments and threat landscapes. These engagements have varied significantly in scope and complexity, offering us a wealth of insights into both our successes and the challenges we’ve faced.   

In this article, we’ll delve into the most effective techniques and social engineering scenarios we employed during these engagements, as well as discuss the obstacles we encountered and how we navigated them. 

Red Team Overview

While each red team assessment may have specific requirements and objectives, several core elements are consistent across all engagements:

1. Objective: The primary goal of any FedRAMP red team assessment is to gain unauthorized access to the FedRAMP boundary. Beyond this, the engagement also assesses the organization’s detection and response capabilities, as well as any other objectives agreed upon.
   
   
2. Starting Point: Each assessment begins with the perspective of an unauthenticated attacker with no prior knowledge of the target organization. This requires extensive Open Source Intelligence (OSINT) gathering to identify potential entry points such as hosts, IP addresses, email addresses, and third-party services.
   
   
3. Timeboxed: Red team engagements are typically timeboxed, with durations ranging from 4 to 8 weeks. This relatively short timeframe contrasts with the prolonged efforts and resources that real-world threat actors often invest when targeting organizations. 

 These elements provide a foundation for the detailed exploration of specific techniques, challenges, and successes that we will delve into in the following sections. 

Top Access Methods

For an external threat actor, the initial challenge is securing access to the target environment. This often involves exploiting vulnerabilities in publicly accessible services or acquiring valid credentials/tokens for employee accounts. In the sections below, we will explore some of the most effective methods our team has used to overcome these challenges and gain initial access.

Phishing

Phishing remains the most effective method for gaining initial access to company resources. Many organizations rely on identity providers, and compromising these can grant access to multiple SaaS applications and valuable resources. In many cases, breaching a SaaS application can be more favorable than accessing an individual user's workstation. To increase the success rate of phishing attempts, consider the following best practices: 

• Utilize well-known email services: Sending phishing emails from reputable services like Microsoft Office 365, Gmail, or SendGrid can enhance credibility and improve the likelihood of the email being opened. 
  
  
• Choose aged and relevant domain names: Use domain names that are established and contextually aligned with your phishing campaign. This adds authenticity and reduces suspicion. 
  
  
• Close the loop on phishing scenarios: If a user interacts with your phishing email, ensure you provide a follow-up message indicating that their task is complete. This helps prevent them from questioning what to do next and potentially reporting the email. 
  
  
• Configure phishing infrastructure wisely: Set up your phishing infrastructure to block known scanners and bots to avoid detection. Implement measures such as access restrictions based on specific links, browser-based checks, and client-side fingerprinting techniques like JA4H. 
  
  
• Track email engagement: Configure your phishing emails to monitor opens and clicks. This helps determine whether the emails are reaching their intended targets and if they’re engaging with the content.  

One of our most successful techniques involves adversary-in-the-middle (AiTM) attacks. This method proxies the user's web traffic through a phishing page that mimics the legitimate login page, enabling the capture of credentials and session tokens. This technique is effective in gaining initial access to sensitive documents and various services. However, crafting a convincing phishing email to prompt the target to visit the phishing page remains a key challenge.

A particularly effective tactic we’ve used was incorporating a fake "Report Phishing" banner in our emails. When targets click on this banner, they believe they are taking a legitimate action, but the link redirects them to a phishing page designed to capture their credentials and session tokens. An example of this technique includes mimicking the Gmail phishing report banner:

Additionally, to bypass network security controls, we sometimes include QR codes in our phishing emails. For instance, we might suggest that the target scan the QR code to re-authenticate their mobile device to avoid account lockout. This tactic leverages mobile devices to increase the chances of successfully capturing credentials. 

 Overall, phishing continues to be a powerful tool for initial access, with each scenario varying based on the client and the intelligence gathered during reconnaissance. 

Vishing

Although phishing remains a powerful tool, some clients present more challenging scenarios where traditional methods may fall short. In such cases, vishing—voice phishing—becomes a viable alternative for gaining initial access. During the reconnaissance phase, identifying phone numbers can open the door to vishing attempts. These can range from calling the helpdesk to extract information about company procedures or authentication processes, to directly engaging with targets in a manner that persuades them to disclose sensitive information or visit our phishing site. For a closer look at the dangers of abusing business processes, please refer to The Hidden Threat Within: Applying Red Team Tactics to Business Workflows.

Fax

One of the most unique and successful social engineering tactics we employed this year involved sending a fax to the client. Although faxing is less common in today’s digital age , this method effectively bypasses many email security controls. For one particular campaign, we created a simple document featuring only a QR code. When scanned, the QR code directed the target to a phishing website where their credentials were captured. 

With more time and creativity, a faxed document could be crafted to include additional persuasive details, such as a compelling reason for the fax, or contact information designed to prompt the recipient to call and divulge further information.

Challenges and Difficulties

Despite achieving successful access to clients' environments throughout the year, red team engagements have presented a range of challenges. As detection and response capabilities continue to advance, they increasingly complicate our efforts to compromise environments. Here are some key difficulties we’ve encountered:

External Network Challenges

One of the primary obstacles has been gaining a foothold within a client’s environment via external network vulnerabilities or misconfigurations. While identifying such issues can contribute to enhancing the client's security posture, social engineering remains the most reliable method for initial compromise. The robustness of modern external defenses means that traditional approaches often require more creative or persistent strategies.

Increasing Complexity of Phishing

Phishing remains a cornerstone of our social engineering tactics, but it has grown more challenging over time. Improvements in email filtering and security controls make it increasingly difficult to ensure that phishing emails land in the target's inbox. The frustration of investing considerable time and effort into crafting and deploying phishing campaigns only to receive minimal engagement, sometimes with no clicks at all, can be disheartening. It’s often unclear whether the email even reached the target or was caught by advanced filtering systems, as there is no feedback mechanism.

Challenges in Cloud Environments

Even when we manage to capture credentials and session tokens, many applications require additional multi-factor authentication (MFA) to access resources. This could involve a push notification to a phone or biometric verification, which can hinder our ability to pivot to other applications. Moreover, many organizations host critical applications internally and restrict access through company VPNs. Consequently, compromising a target's identity provider account does not automatically grant access to all configured applications, especially if they are VPN-restricted.

Malicious Insiders

Given the previously discussed difficulties and in an effort to provide the most value to the client, some have elected to perform an additional vector, providing Schellman access from the perspective of a malicious insider. In this assessment, the goal is to determine how damaging a newly hired malicious insider could be by attempting data exfiltration or lateral movement.  This threat can be tailored to the client’s needs and comfort by onboarding the Schellman Red Team member as a full-time employee with the standard access and hardware provided, or limited to simply an email account to simulate a phished user to act as a foothold.

Closing Remarks

The first year of FedRAMP red team engagements has been highly enlightening for many clients, delivering significant value in enhancing their detection and security controls. As the threat landscape evolves, we can expect to encounter new and innovative techniques. Staying ahead of these developments will be crucial in bypassing robust security defenses and adapting our strategies to meet emerging challenges. 

For more information on red team assessments, make sure to check out our other articles detailing different aspects that can help: 

• What is Red Teaming? 
• Red Team Methodology: Understanding the Stages 
• FedRAMP Red Team Assessments FAQ 
• Recommendations For Self-Managed FedRAMP Red Team Exercises 
• Penetration Testing vs. Red Teaming