Lazarus exploit Log4Shell vulnerability to deliver novel RAT malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×9 |
| masshundreds of millions of Java applications/devices, with hundreds of thousands of internet-exposed services |
Full article467 words · extracted from helpnetsecurity.com · click to collapse
North Korea-backed group Lazarus has been spotted exploiting the Log4Shell vulnerability (CVE-2021-44228) and novel malware written in DLang (i.e., the memory-safe D programming language).
“This campaign consists of continued opportunistic targeting of enterprises globally that publicly host and expose their vulnerable infrastructure to n-day vulnerability exploitation such as CVE-2021-44228. We have observed Lazarus target manufacturing, agricultural and physical security companies,” Cisco Talos researchers shared.
Log4Shell still opens doors
Log4Shell is a critical remote code execution (RCE) vulnerability in Apache Log4j – a popular and widely used Java logging library – that was discovered and privately disclosed in late November, 2021, patched on December 6, and quickly started getting exploited by attackers.
Two years later, 38 percent of applications still use a vulnerable version of Log4j, according to Veracode.
Deploying novel DLang-based malware
Dubbed “Operation Blacksmith” by Cisco Talos, the attack started with the threat actors gaining initial access by exploiting the Log4Shell vulnerability in publicly facing VMWare Horizon servers.
After a successful exploit, the attackers performed extensive reconnaissance and finally OS credential dumping.
Then they deployed HazyLoad – a custom-made proxy tool – to gain continuous access, create a new local user account, and download credential dumping tools (ProcDump, MimiKatz), as well as a novel DLang-based remote access trojan (RAT) called NineRAT, which was first spotted in a campaign in March 2023.
NineRAT uses Telegram for command and control (C2) communication, transfering files and evading detection. It also uses a dropper binary to gain persistence and execute additional binaries.
Infection chain observed in Operation Blacksmith. (Source: Cisco Talos)
The researchers also discovered two more DLang-based malware families used by Lazarus in this campaign:
- DLRAT is a RAT and a downloader that allows attackers to perform system reconnaissance, deploy additional malware, fetch C2 commands and execute them on the endpoints
- BottomLoader is “simply a downloader” that retrieves and executes payloads, such as HAzyLoad, from a remote host
North Korean hackers are shifting tactics
In the last year and a half, North Korean threat actors have started using uncommon technologies to write malware: DLang, the Qt Framework and PowerBasic.
Talos researchers have found similarities between these and the attacks conducted in October, 2023 by a North Korea-backed hacking group named Onyx Sleet (aka PLUTONIUM or Andariel).
“Talos agrees with other researchers’ assessment that the Lazarus APT is essentially an umbrella of sub-groups that support different objectives of North Korea in defense, politics, national security and research and development. Each sub-group operates its own campaigns and develops and deploys bespoke malware against their targets, not necessarily working in full coordination,” Cisco Talos researchers said.
“Andariel is typically tasked with initial access, reconnaissance and establishing long-term access for espionage in support of North Korean government interests. In some cases, Andariel has also conducted ransomware attacks against healthcare organizations.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/12/12/lazarus-log4shell/