Praying Mantis APT targets IIS servers with ASP.NET exploits
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11317 | Unrestricted File Upload / RCE in Progress Telerik UI for ASP.NET AJAX Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and in R2 releases before R2 2017 SP2 uses weak encryption for the RadAsyncUpload component, allowing unauthenticated remote attackers to forge upload parameters, upload arbitrary files to the web server, and ultimately execute arbitrary code. The flaw is triggered simply by sending crafted requests to the vulnerable upload handler over the network, with no authentication or user interaction required. Successful exploitation gives an attacker arbitrary file upload and remote code execution in the context of the ASP.NET application, which is typically hosted on IIS web servers. Any site or application built with Telerik UI for ASP.NET AJAX is affected, and the weakness is confirmed exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11, and related reporting describes multiple hacking groups — including IIS/ASP.NET-focused APT actors — breaching a U.S. federal agency through it. Do: Upgrade Telerik UI for ASP.NET AJAX to R1 2017 or R2 2017 SP2 (or later) per vendor instructions, and verify the deployed Telerik.Web.UI.dll version in each application's bin folder. Given active in-the-wild exploitation of IIS/ASP.NET applications, review affected web servers for unauthorized uploads and web shells and rotate ASP.NET machine keys used with RadAsyncUpload. | 9.8 | 84% | KEV PoC ×2 |
| large≈tens of thousands of internet-exposed ASP.NET/IIS applications; the total installed base (including internal apps) is plausibly far larger | |
| CVE-2019-18935 | Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX CVE-2019-18935 is a .NET deserialization flaw (CWE-502) in the RadAsyncUpload function of Progress Telerik UI for ASP.NET AJAX through version 2019.3.1023. It is triggered when an attacker who knows the Telerik upload encryption keys — most commonly because the earlier flaws CVE-2017-11317 or CVE-2017-11357 exposed them, though keys can be obtained by other means — sends crafted serialized data to RadAsyncUpload, allowing remote code execution without authentication. Successful exploitation gives an attacker arbitrary code execution on the hosting IIS/ASP.NET web server, reflected in the critical 9.8 CVSS score. Any web application built with Telerik UI for ASP.NET AJAX at or below 2019.3.1023 is affected, unless 2019.3.1023 has the non-default hardening setting enabled (as of 2020.1.114 a default setting prevents the exploit). Exploitation is rampant in the wild: the flaw was added to CISA KEV on 2021-11-03 with known ransomware use, carries a 99.7% EPSS probability of exploitation, has multiple public exploits (Bishop Fox, RAU_crypto, noperator), and has been used by multiple threat groups — including ransomware and government-linked actors — to breach organizations including a U.S. federal agency. Do: Upgrade to Progress Telerik UI for ASP.NET AJAX 2020.1.114 or later, where a default setting prevents exploitation (or, if staying on 2019.3.1023, enable the non-default hardening setting); per CISA KEV, apply updates per vendor instructions. Because exploitation requires the encryption keys to be known, also patch the older CVE-2017-11317/CVE-2017-11357 key-disclosure flaws or rotate the Telerik upload encryption keys. Check internet-facing IIS/ASP.NET applications for exposed RadAsyncUpload handlers and indicators of compromise, given known ransomware and federal-agency breaches. | 9.8 | 100% | KEV ransomware PoC ×4 |
| largeTens of thousands of internet-exposed ASP.NET/IIS web applications using Telerik controls (order-of-magnitude estimate) | |
| CVE-2021-27852 | Unauthenticated Deserialization RCE in Checkbox Survey 6 and Earlier CVE-2021-27852 is a deserialization of untrusted data flaw (CWE-502) in CheckboxWeb.dll of Checkbox Survey, allowing an unauthenticated remote attacker to execute arbitrary code. An attacker triggers it by sending maliciously crafted serialized data to the vulnerable application over the network, without needing credentials. Successful exploitation yields arbitrary code execution on the server hosting the survey application. Only Checkbox Survey versions 6 and earlier are affected; versions 7 and later are not considered vulnerable, but version 6 and earlier is end-of-life. The flaw is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-04-11), indicating known exploitation, and EPSS estimates a 31.9% probability of exploitation within 30 days (98th percentile), though no public proof-of-concept is known. Do: Per CISA's required action, remove Checkbox Survey versions 6 and earlier from agency networks, as they are end-of-life, or upgrade to version 7 or later, which is not considered vulnerable. Check for internet-facing servers exposing CheckboxWeb.dll/Checkbox Survey endpoints and treat any version 6 or earlier installation as potentially compromised. Monitor CISA guidance, since ransomware association is currently unknown and CVSS scoring is pending. | 9.8 | 32% | KEV |
| — |
Full article584 words · extracted from therecord.media · click to collapse
A new advanced persistent threat (APT) group has been seen carrying out attacks against Microsoft IIS web servers using old exploits in ASP.NET applications in order to plant a backdoor and then pivot to companys' internal networks. Tracked as Praying Mantis or TG1021, the group's attacks have been documented in a report published earlier today by Israeli security firm Sygnia. "These attacks targeted prominent organizations and compromised their networks by exploiting internet-facing servers," the Sygnia team said today. For these attacks, Praying Mantis relied on exploits to get a foothold on IIS servers running outdated ASP.NET apps and then used a malware framework that Sygnia said was custom-made to target IIS servers. This framework, which consisted of fileless malware strains that executed inside the server's memory to avoid detection, was split into two subgroups. The first stage group, which consisted of the NodeIISWeb malware, was designed to backdoor the IIS server and contained functionality to intercept and handle HTTP requests received by the server. The second stage malware was designed to help Praying Mantis spread to the internal network and included several post-exploitation modules to perform network reconnaissance, elevate privileges, and move laterally within networks. To gain their initial foothold on IIS servers, Praying Mantis typically relied on four deserialization exploits targeting Windows IIS servers and web applications, listed below: Sygnia said the nature of the activity and general modus-operandi suggest Praying Mantis is an experienced threat actor highly aware of OPSEC (operations security) procedures. The malware used by [Praying Mantis] TG1021 shows a significant effort to avoid detection, both by actively interfering with logging mechanisms, successfully evading commercial EDRs and by silently awaiting incoming connections, rather than connecting back to a C2 channel and continuously generating traffic. Furthermore, the threat actor actively removed all disk-resident tools after using them, effectively giving up on persistency in exchange for stealth. "Sygnia has identified and linked malicious activities to this group starting from mid-2020. Initial identification was through our response to a potential compromise. This gradually unfolded the attack and toolset, which made it more trackable," the Sygnia team told The Record today in an interview. "Our belief is that the group is associated with a particular state-sponsored entity, according to its highly stealthy modus operandi and victimology. The victims were prominent companies in the US private sector," the security firm added. In its report, Sygnia said the group's tactics, techniques, and procedures (TTPs) are similar to those described in a June 2020 security alert [PDF] from the Australian Cyber Security Centre, which detailed a series of attacks against Australian government and private organizations by a group the agency nicknamed Copy-Paste, due to its tendency to use open source public exploits. However, some of the same exploits have also been abused by a crypto-mining gang tracked as Blue Mockingbird. However, Sygnia has not yet made a formal attribution of the Praying Mantis attacks besides highlighting the TTP overlaps. TG1021 (Praying Mantis) indicators of compromise (IOCs) are available in Sygnia's report. Article updated shortly after publication with Sygnia comments.
No previous article
No new articles
Catalin Cimpanu
is a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/praying-mantis-apt-targets-iis-servers-with-asp-net-exploits