Espionage campaign exploits ManageEngine ADSelfService Plus vulnerability. TA505 exploits SolarWinds Serv-U flaw to deploy ransomware.

Summary

By the CyberWire staff

At a glance.

Espionage campaign exploits ManageEngine ADSelfService Plus vulnerability.
TA505 exploits SolarWinds Serv-U flaw to deploy ransomware.
Mekotio banking Trojan uses new infection technique.

Espionage campaign exploits ManageEngine ADSelfService Plus vulnerability.

Researchers at Palo Alto Networks' Unit 42 describe a cyberespionage campaign that's exploiting a vulnerability in Zoho's ManageEngine ADSelfService Plus single-sign on (SSO) solution. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert concerning this vulnerability, CVE-2021-40539, in September 2021. CISA says the flaw is "an authentication bypass vulnerability affecting representational state transfer (REST) application programming interface (API) URLs that could enable remote code execution."

Unit 42 says that between September 22nd and early October "the actor successfully compromised at least nine global entities across the technology, defense, healthcare, energy, and education industries." The researchers haven't yet attributed the campaign to any particular threat actor, but they note similarities to previous campaigns by the Chinese APT APT27 or Emissary Panda. The threat actor is deploying the Godzilla web shell and the NGLite Trojan (both of which are publicly available), as well as a new credential stealer called "KdcSponge":

"Following initial exploitation, a payload was uploaded to the victim network which installed a Godzilla webshell. This activity was consistent across all victims; however, we also observed a smaller subset of compromised organizations who subsequently received a modified version of a new backdoor called NGLite. The threat actors then used either the webshell or the NGLite payload to run commands and move laterally to other systems on the network, while they exfiltrated files of interest simply by downloading them from the web server. Once the actors pivoted to a domain controller, they installed a new credential-stealing tool that we track as KdcSponge.

"Both Godzilla and NGLite were developed with Chinese instructions and are publicly available for download on GitHub. We believe threat actors deployed these tools in combination as a form of redundancy to maintain access to high-interest networks. Godzilla is a functionality-rich webshell that parses inbound HTTP POST requests, decrypts the data with a secret key, executes decrypted content to carry out additional functionality and returns the result via a HTTP response. This allows attackers to keep code likely to be flagged as malicious off the target system until they are ready to dynamically execute it."

TA505 exploits SolarWinds Serv-U vulnerability to deploy ransomware.

NCC Group researchers are tracking an uptick in Clop ransomware attacks leveraging a remote code execution vulnerability in SolarWinds Serv-U (CVE-2021-35211). The vulnerability was disclosed by Microsoft in July. NCC Group attributes these attacks to the cybercriminal actor TA505, noting, "We believe exploiting such vulnerabilities is a recent initial access technique for TA505, deviating from the actor’s usual phishing-based approach."

NCC Group advises that users update systems running SolarWinds Serv-U software to the most recent version. The researchers note that, as of October, 66.5% (2,784) of Serv-U instances around the world remained vulnerable.

Mekotio banking Trojan uses new infection technique.

Check Point has observed the Mekotio Latin American banking Trojan using a new infection flow. The researchers explain, "In the last 3 months, we saw approximately 100 attacks use new, simple obfuscation techniques, with the help of a substitution cipher, to hide the first module of the attack. This simple obfuscation technique allows it to go undetected by most of the AntiVirus products."

Check Point notes that some of the malware's operators were arrested in Spain earlier this year, but the primary gang appears to be active in Brazil:

"The new campaign started right after the Spanish Civil Guard announced the arrest of 16 people involved with Mekotio distribution in July 2021. It appears that the gang behind the malware were able to narrow the gap quickly and change tactics to avoid detection. We assume that the main cybercrime groups are operating from Brazil and they collaborated with Spanish gangs to distribute malware. The arrest stopped the activity of the Spanish gangs but not the main cybercrime groups."

Selected Reading

Mekotio Banker Returns with Improved Stealth and Ancient Encryption (Check Point Research) Research by: Arie Olshtein & Abedalla Hadra A banking Trojan called “Mekotio” that targeted Latin America countries in the past, now making a comeback with a change in its infection flow. Check Point Research (CPR) detected over 100 attacks in recent weeks using the Trojan’s new technique The infection starts out and distributed with a... Click to Read More

The Vagabon Kit Highlights ‘Frankenstein’ Trend in Phishing (RiskIQ) In early 2021, RiskIQ first detected a new phishing campaign targeting PayPal. The campaign, authored by an actor calling themself "Vagabon," looks to collect PayPal login credentials and complete credit card information from the victim.

Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk (Cisco Talos) A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group

KdcSponge, NGLite, Godzilla Webshell Used in Targeted Attack Campaign (Unit42) A malicious campaign against ManageEngine ADSelfService Plus used Godzilla webshells, the NGLite backdoor and KdcSponge, a credential stealer.

Take a survey, spam your friends, download fleeceware (Avast) Avast researcher Jakub Vavra recently found fraudulent sites posing as national postal service sites in Germany, Austria, the UK, Belarus, Czech Republic, Russia, and Slovakia, as well as retail shops from the Ukraine and Russia.

Caught Beneath the Landline: A 411 on Telephone Oriented Attack Delivery (Proofpoint) Proofpoint researchers observe tens of thousands of telephone oriented cyberattacks daily. There are two types of these threats regularly observed by Proofpoint. One features traditional call center fraud, such as fake tech support, to steal money. The second leverages call centers to distribute malware that could be used for secondary compromises. Proofpoint is aware of individual victims losing nearly $50,000 per attack. It is likely that number is greater. Malware distributed in some of the observed campaigns could lead to ransomware and pose a greater risk to business operations.

Devices of Palestinian Human Rights Defenders Hacked with NSO Group’s Pegasus Spyware (The Citizen Lab) Front Line Defenders’ analysis indicated that six devices belonging to six Palestinian human rights defenders were hacked with Pegasus, a spyware developed by the cyber-surveillance company NSO Group. Both the Citizen Lab and Amnesty International’s Security Lab independently confirmed these findings.