Hackers Deploy Shadowpad Backdoor and Target Industrial Control Systems in Asia
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing. Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use. | 9.1 | 100% | KEV ransomware PoC ×4 |
| masshundreds of thousands of on-premises deployments; tens of thousands of internet-exposed Exchange servers |
Full article357 words · extracted from infosecurity-magazine.com · click to collapse
Russian cybersecurity firm Kaspersky uncovered an attack campaign targeting unpatched Microsoft Exchange servers in different Asian countries.
According to an advisory released by the company on Monday, once they gained initial access via the above vulnerabilities, the threat actors deployed the ShadowPad malware on the industrial control systems (ICS) of telecommunications companies in Pakistan and Afghanistan and a logistics and a transport organization in Malaysia.
Kaspersky said it first spotted the threat in October 2021, with the hackers exploiting the CVE-2021-26855 vulnerability in Microsoft Exchange. However, signs of the attacks on affected systems seem to date back as far as March 2021.
“During the investigation, researchers uncovered larger-scale activity by the threat actor in the network of the telecommunications company and also identified other victims of the campaign,” reads the advisory.
Throughout the attack campaign, the ShadowPad backdoor was reportedly downloaded to victim computers as the mscoree.dll file, which was, in turn, launched by a legitimate executable file named AppLaunch.exe.
Attackers would then launch ShadowPad using DLL hijacking in OleView, a legitimate OLE-COM object viewing application. Once they gained the initial foothold into the system, the threat actors would send commands manually, then automatically.
Additional tools used by the hackers during these cyber-attacks reportedly include the CobaltStrike framework, the PlugX backdoor and various BAT files. A complete list is available in the original text of the advisory.
In terms of attribution, Kaspersky said the newly identified attacks on a variety of organizations had an almost totally unique set of tactics, techniques and procedures (TTP).
“The attackers’ TTP enabled us to link these attacks to a Chinese-speaking threat actor, and we observed victims located in different regions. This means that the actor we have identified may have broader geographical interests and we could expect more victims to be discovered in different countries in the future.”
At the time of writing, however, the antivirus company said they could not be sure of the ultimate goal of the attacker, but they think it may be data harvesting.
“We believe that it is highly likely that this threat actor will strike again and we will find new victims in different countries.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/hackers-deploy-shadowpad-asia/