Prometei botnet is targeting ProxyLogon Microsoft Exchange flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-27065 +1 in the same advisory: …26858 | ProxyLogon chain RCE in Microsoft Exchange Server (CVE-2021-27065) CVE-2021-27065 is a remote code execution vulnerability in on-premises Microsoft Exchange Server, best known as the file-write component of the ProxyLogon exploit chain disclosed in March 2021. The flaw lets an attacker write arbitrary files, such as web shells, to the Exchange web server, and when chained with the pre-authentication SSRF bug in the same ProxyLogon chain it yields fully unauthenticated code execution on the server. Successful exploitation gives attackers the ability to run commands as the Exchange server, access organizational email and data, establish persistence, and — as CISA notes — it has been used as a foothold for ransomware deployment. Any organization running an affected on-premises Exchange Server is exposed, particularly when Outlook Web Access or other Exchange endpoints are internet-reachable; this is a server-product flaw, not an Exchange Online/cloud-mailbox issue. Exploitation is confirmed and widespread: it is in the wild with known ransomware use, CISA added it to the KEV on 2021-11-03, and EPSS assigns a ~99.9% probability of exploitation within 30 days. Do: Apply Microsoft's March 2021 (or later) Exchange Server security updates immediately, consistent with CISA's required action to apply vendor updates. Hunt for ProxyLogon indicators — web shells under the Exchange FrontEnd HttpProxy folders (e.g., in owa/auth), unexpected files in the OAB virtual directory, and ransomware artifacts — using Microsoft's Safety Scanner or the Test-ProxyLogon tooling, and treat any hit as a full intrusion (scope persistence and rotate exposed credentials). If patching must be deferred, restrict or remove internet exposure of OWA/ECP and apply interim mitigations while monitoring for ransomware deployment. | 7.8 | 100% | KEV ransomware PoC ×2 |
| mass≈300,000–600,000 internet-exposed on-prem Exchange servers (order of magnitude: hundreds of thousands) |
Full article621 words · extracted from securityaffairs.com · click to collapse
Attackers are exploiting the ProxyLogon flaws in Microsoft Exchange to recruit machines in a cryptocurrency botnet tracked as Prometei.
Experts from the Cybereason Nocturnus Team have investigated multiple incidents involving the Prometei Botnet. The attackers hit companies in North America and threat actors exploited the ProxyLogon Microsoft Exchange flaws (CVE-2021-27065 and CVE-2021-26858) to deliver malware in their networks. Attackers are exploiting the ProxyLogon flaws in Microsoft Exchange to recruit machines in a cryptocurrency botnet tracked as Prometei.
The Prometei botnet appears to be active at least since March 2020, but it was first observed by Cisco Talos experts in July 2020. A deep investigation of artifacts uploaded on VirusTotal allowed the experts to determine that the botnet may have been active at least since May 2016. Experts pointed out that the malware has constantly been updated by its creators with the implementation of new modules and features.
The crypto-mining botnet has a modular structure and employs multiple techniques to infect systems and evade detection.
“Prometei exploits the recently disclosed Microsoft Exchange vulnerabilities associated with the HAFNIUM attacks to penetrate the network for malware deployment, credential harvesting and more.” reads the analysis published by Cybereason. “The victimology is quite random and opportunistic rather than highly targeted, which makes it even more dangerous and widespread. Prometei has been observed to be active in systems across a variety of industries, including: Finance, Insurance, Retail, Manufacturing, Utilities, Travel, and Construction.”
Experts observed that the crooks behind this botnet explicitly avoid infecting targets in former Soviet bloc countries.
Prometei targets both Windows-based and Linux-Unix-based delivering the appropriate payload based on the operating system. In order to make the botnet resilient to C2 takeover, the bot is able to interact with four different command-and-control (C2) servers.
In the incidents investigated by Cyberreason, threat actors exploit the CVE-2021-27065 and CVE-2021-26858 flaws to deploy the China Chopper web shell to gain persistent access to the network. Then the threat actor launched PowerShell to download the initial Prometei payload from a remote server.
The PowerShell downloads a payload from a remote server that start of the Prometei botnet execution launching the main bot module (Zsvc.exe) which prepares the ground” for the other modules:
The bot supports a broad range of commands, experts also observed a module called “Microsoft Exchange Defender” that masquerades as a legitimate Microsoft product, which is used to remove other competing web shells.
Due to the modular structure, the malware will continue to evolve, and threat actors behind the botnet will implement new features to improve evasion capabilities and allow to infect a large number of devices as possible.
“The different components work together to enable the malware to perform many tasks: credential harvesting, spreading across the network, establishing C2 communications and more. The malware authors are able to add more modules and expand their capabilities easily, and potentially even shift to another payload objective, more destructive than just mining Monero.” concludes the report.
“Threat actors in the cybercrime community continue to adopt APT-like techniques and improve efficiency of their operations. As observed in the recent Prometei attacks, the threat actors rode the wave of the recently discovered Microsoft Exchange vulnerabilities and exploited them in order to penetrate targeted networks. This threat poses a great risk for organizations, since the attackers have absolute control over the infected machines, and if they wish so, they can steal information, infect the endpoints with other malware or even collaborate with ransomware gangs by selling the access to the infected endpoints.”
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Prometei)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/117229/malware/prometei-botnet-is-targeting-proxylogon-microsoft-exchange-flaws.html