Monero-mining botnet targets orgs through recent MS Exchange vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-27065 +1 in the same advisory: …26858 | ProxyLogon chain RCE in Microsoft Exchange Server (CVE-2021-27065) CVE-2021-27065 is a remote code execution vulnerability in on-premises Microsoft Exchange Server, best known as the file-write component of the ProxyLogon exploit chain disclosed in March 2021. The flaw lets an attacker write arbitrary files, such as web shells, to the Exchange web server, and when chained with the pre-authentication SSRF bug in the same ProxyLogon chain it yields fully unauthenticated code execution on the server. Successful exploitation gives attackers the ability to run commands as the Exchange server, access organizational email and data, establish persistence, and — as CISA notes — it has been used as a foothold for ransomware deployment. Any organization running an affected on-premises Exchange Server is exposed, particularly when Outlook Web Access or other Exchange endpoints are internet-reachable; this is a server-product flaw, not an Exchange Online/cloud-mailbox issue. Exploitation is confirmed and widespread: it is in the wild with known ransomware use, CISA added it to the KEV on 2021-11-03, and EPSS assigns a ~99.9% probability of exploitation within 30 days. Do: Apply Microsoft's March 2021 (or later) Exchange Server security updates immediately, consistent with CISA's required action to apply vendor updates. Hunt for ProxyLogon indicators — web shells under the Exchange FrontEnd HttpProxy folders (e.g., in owa/auth), unexpected files in the OAB virtual directory, and ransomware artifacts — using Microsoft's Safety Scanner or the Test-ProxyLogon tooling, and treat any hit as a full intrusion (scope persistence and rotate exposed credentials). If patching must be deferred, restrict or remove internet exposure of OWA/ECP and apply interim mitigations while monitoring for ransomware deployment. | 7.8 | 100% | KEV ransomware PoC ×2 |
| mass≈300,000–600,000 internet-exposed on-prem Exchange servers (order of magnitude: hundreds of thousands) |
Full article485 words · extracted from helpnetsecurity.com · click to collapse
The recent Microsoft Exchange Server vulnerabilities might have initially been exploited by a government-backed APT group, but cybercriminals soon followed suit, using them to deliver ransomware and grow their botnet.
One perpetrator of the latter activities is Prometei, a cross-platform (Windows, Linux), modular Monero-mining botnet that seems to have flown under the radar for years.
The attackers’ modus operandi
Cybereason incident responders have witnessed instances of the botnet enslaving endpoints of companies across the globe, in a variety of industries.
“The victimology is quite random and opportunistic rather than highly targeted, which makes it even more dangerous and widespread,” shared Lior Rochberger, senior threat researcher at Cybereason.
One thing that the responders noticed, though, is that the botnet avoids targets in former Soviet bloc countries. For these reasons and others, they believe it is operated by Russian-speaking cybercriminals and not state-sponsored threat actors.
Aside from exploiting CVE-2021-27065 and CVE-2021-26858, two MS Exchange vulnerabilities, the botnet also uses known exploits (EternalBlue and BlueKeep) to leverage old security issues in the SMB and RDP protocols and brute-forces SSH credentials to spread to as many endpoints on the compromised network as possible.
Prometei’s attack sequence
The malware is also adept at remaining hidden from defenders and preventing other potential attackers from using the compromised endpoints.
It uses a variety of persistence techniques and create firewall rules and registry keys to make sure communication with C&C servers can be established. It uses a customized version of Mimikatz to harvest credentials.
It also adds firewall rules to block certain IP addresses used by other (crypto-mining) malware, and uses a module that masquerades as a legitimate Microsoft endpoint security program to constantly check a directory often used to host web shells.
“The malware is specifically interested in the file ‘ExpiredPasswords.aspx’, which was reported to be the name used to obscure the HyperShell backdoor used by APT34 (aka. OilRig). If the file exists, the malware immediately deletes it,” Rochberger explained.
“Our assessment is that this tool is used to ‘protect’ the compromised Exchange Server by deleting potential WebShells so Prometei will remain the only malware using its resources.”
An old threat?
Prometei was first discovered and documented by Cisco Talos researchers in 2020, but Cybereason researchers found evidence that it might date back as far as 2016 and has been evolving ever since, adding new modules and techniques to its capabilities.
“During our investigation, we found different components of the old infrastructure that are now sinkholed, taken down,” Assaf Dahan, Senior Director, Head of Threat Research, Cybereason, told Help Net Security.
“Between 2019-early 2020, the operators of Prometei made some significant changes to the botnet, which included using 4 different C2 servers embedded in the code – in an attempt to make the botnet more resilient to takedowns. We assess that the latest surge of compromises related to Prometei is another attempt to further build the botnet and expand their operation.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/04/22/botnet-exchange-vulnerabilities/