SUMMARY
The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Cyber National Mission Force (CNMF) identified the presence of indicators of compromise (IOCs) at an Aeronautical Sector organization as early as January 2023. Analysts confirmed that nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing application (Zoho ManageEngine ServiceDesk Plus), establish persistence, and move laterally through the network. This vulnerability allows for remote code execution on the ManageEngine application. Additional APT actors were also observed exploiting CVE-2022-42475 to establish presence on the organization’s firewall device.
CISA and co-sealers are releasing this joint Cybersecurity Advisory (CSA) to provide network defenders with tactics, techniques, and procedures (TTPs), IOCs, and methods to detect and protect against similar exploitation.
Download the PDF version of this report:
For a downloadable copy of IOCs, see:
For a downloadable copy of the Malware Analysis Report (MAR) accompanying this CSA, see:
Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 13. See Tables 3-13 for the APT actors’ activity mapped to MITRE ATT&CK tactics and techniques with corresponding mitigation and/or detection recommendations.
Overview
By request of the impacted organization, CISA conducted an incident response engagement from February to April 2023. CISA and co-sealers assess that beginning as early as January 2023, multiple nation-state APT actors were present on the organization’s network via at least two initial access vectors:
- Initial Access Vector 1: APT actors exploited CVE-2022-47966 to access the organization’s web server hosting the public-facing application, Zoho ManageEngine ServiceDesk Plus.
- Initial Access Vector 2: APT actors exploited CVE-2022-42475 to access the organization’s firewall device.
CISA and co-sealers identified an array of threat actor activity, to include overlapping TTPs across multiple APT actors. Per the activity conducted, APT actors often scan internet-facing devices for vulnerabilities that can be easily exploited. Firewall, virtual private networks (VPNs), and other edge network infrastructure continue to be of interest to malicious cyber actors. When targeted, they can be leveraged to expand targeted network access, serve as malicious infrastructure, or a mixture of both.
APT Actor Activity
Initial Access Vector 1
As early as January 2023, APT actors exploited CVE-2022-47966 [T1190] for initial access to the organization’s web server hosting the public-facing application, Zoho ManageEngine ServiceDesk Plus. CISA observed indications in log files that a connection to the known malicious IP address 192.142.226[.]153 was made as part of initial exploitation.
Through exploitation of CVE-2022-47966, APT actors achieved root level access on the web server and created a local user account [T1136.001] named Azure with administrative privileges [T1068]. Actors were further able to download malware, enumerate the network, collect administrative user credentials, and move laterally through the organization’s network. CISA and co-sealers were unable to determine if proprietary information was accessed, altered, or exfiltrated. This was due to the organization not clearly defining where their data was centrally located and CISA having limited network sensor coverage.
Initial Access Vector 2
Additional APT actors exploited CVE-2022-42475 on the organization’s firewall device, which was indicated by multiple successful VPN connections from known-malicious IPs between February 1-16, 2023. It was identified that APT actors compromised and used disabled, legitimate administrative account credentials [T1078.003] from a previously hired contractor—of which the organization confirmed the user had been disabled prior to the observed activity.
Analysis identified that a common behavior for these threat actors was to use disabled administrative account credentials and delete logs from several critical servers in the environment [T1070.001]. This prevented the ability to detect follow-on exploitation or data exfiltration. CISA and co-sealers were also unable to further track the activity due to the organization not having Network Address Translation (NAT) IP logging enabled.
APT actors initiated multiple Transport Layer Security (TLS)-encrypted sessions [T1573.002] on Transmission Control Protocol (TCP) port 10443 [T1571], indicating successful exchanges of data transfer from the firewall device. APT actors were observed connecting to the device from the following actor-controlled C2 IP addresses:
144.202.2[.]71207.246.105[.]24045.77.121[.]23247.90.240[.]218
APT actors further leveraged legitimate credentials to move from the firewall to a web server, where multiple web shells were loaded—among other locations, such as the OWA server—into the following directories. Note: The following file paths to these web shells were received in coordination with a trusted third-party; however, the artifacts were not received for analysis.
c:Program FilesMicrosoft Office Web AppsRootWebsiteen-usresource.aspxc:inetpubwwwrootuninetcssfont-awesomecssdiscover.ashxc:inetpubwwwrootuninetcssfont-awesomecssconfiglogin.ashxc:Program FilesCommon FilesMicrosoft SharedWeb Server Extensions15templatelayoutsapproveinfo.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteinfos.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteerrorinfo.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteinfos.ashxc:Program FilesMicrosoft Office Web AppsRootWebsiteen-userror.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteen-usinfos.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteen-usinfo.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteen-usinfo-1.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteen-usnew_list.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteen-userrorinfo.aspxc:Program FilesMicrosoft Office Web AppsRootWebsiteen-uslgnbotr.ashxc:inetpubpasswordchangeLECPNJYRH.aspxc:inetpubpasswordchange9ehj.aspxc:inetpubwwwrootwssVirtualDirectoriesPortal80_vti_pvtservicesinfo.ashxc:inetpubwwwrootwssVirtualDirectoriesPortal80_vti_pvtservices.aspxc:inetpubredirectedSites[REDACTED]productsuns1fw.aspxc:inetpubredirectedSites[REDACTED]productsuns1ew.aspx
The following IP addresses were identified as associated with the loaded web shells:
45.90.123[.]194154.6.91[.]26154.6.93[.]22154.6.93[.]5154.6.93[.]12154.6.93[.]32154.6.93[.]24184.170.241[.]27191.96.106[.]40102.129.145[.]232
Forensic Timeline of APT Actor Activity
Tables 1 and 2 list the timeline of events discovered during the incident response, as well as tools used by the APT actors to conduct their operations, respectively. All timestamps are presented in Coordinated Universal Time (UTC).
|
Timestamp (UTC) |
Event |
Description |
|
2023-01-18 11:57:02 |
Uniform Resource Identifier (URI): |
|
|
2023-01-20 |
Attempts made to export three files; associated with malicious IP |
APT actors attempted to export [TA0009], [TA0010] three files, which were analyzed and identified as Local Security Authority Subsystem Service (LSASS) dump files. These files were renamed with
Note: If local administrative access is achieved on a victim host, dumping LSASS credentials may allow for lateral movement across the environment. This behavior was identified during the engagement and is detailed throughout Table 1. |
|
2023-01-20 16:51:05 |
Successful web server exploitation via CVE-2022-47966. |
Successful web server (Zoho ManageEngine ServiceDesk Plus) exploitation via CVE-2022-47966. |
|
2023-01-21 06:46:42 |
|
A local user account with administrative permissions, named |
|
2023-01-21 06:49:40 |
LSASS dumped by |
The Note: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. |
|
2023-01-21 06:50:59 |
|
The legitimate ConnectWise ScreenConnect client was utilized to connect to the ServiceDesk system, download Note: ConnectWise ScreenConnect was observed in multiple locations within the organization’s environment, but the organization confirmed that it was not authorized software. Analysis assessed APT actors downloaded the legitimate software for malicious, illegitimate use prior to the download of |
|
2023-01-21 07:34:32 |
|
See MAR-10430311-1.v1 for additional details. |
|
2023-01-21 08:46:23 |
Mimikatz credential dump files created. |
Two files ( |
|
2023-01-21 09:25:58 |
Legitimate files/applications |
Note: Adversaries may gather information about the victim’s network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. |
|
2023-01-21 13:56:14 |
|
APT actors downloaded the file
Note: CISA analyzed these files and did not identify the files as malicious. However, |
|
2023-01-21 14:02:45 |
Ngrok token created, renamed to ngrok.yml config file, and Remote Desktop Protocol (RDP) connection established. |
Ngrok was used to establish an RDP connection [T1021.001]—another method of maintaining persistence on the ServiceDesk system. In this instance, Ngrok was used to establish a reverse proxy connection to the ServiceDesk system. At the time of analysis, the firewall access control lists (ACLs) allowed all outbound connections. Considering APT actors utilized an outbound proxy, the RDP session was successfully established as the connection was initiated from the ServiceDesk system. Note: RDP is a common feature in operating systems, which allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. |
|
2023-01-21 14:31:01 |
SSH tools downloaded to establish reverse (remote) communication. |
Three identified executables, which provide a command line interface with the compromised system, were observed in the following file system locations:
While the files were not identified as malicious, they were loaded for malicious purposes. |
|
2023-01-21 14:33:11 |
|
Analysis identified |
|
2023-01-21 14:51:49 |
PsExec executed on the ServiceDesk system. |
Analysis identified evidence and execution of two files ( APT actors utilized PsExec to create a scheduled task and force-store administrative credentials to the local machine.
Note: PsExec, a command line utility from Microsoft’s Sysinternals Suite, is known to be used for lateral movement; evidence of lateral movement via PsExec has not been confirmed. |
|
2023-01-21 14:55:02 |
ProcDump created on the ServiceDesk system. |
ProcDump was created within the |
|
2023-01-24 15:07:18 |
Apache Log4j exploit attempted against the ServiceDesk system. |
APT actors attempted to exploit a known Apache Log4j vulnerability (CVE-2021-44228) in the ServiceDesk system but were unsuccessful. The two IPs and one domain associated with this exploitation attempt are:
|
|
2023-01-25 00:17:33 |
Mimikatz credential dump files created. |
One file ( Note: This is a different path and time associated with Mimikatz than listed above. |
|
2023-01-29 |
HTTP-GET requests sent to C2 IP |
The server hosting ServiceDesk was observed beaconing/sending HTTP-GET requests to a suspected APT-controlled C2 server, indicating malware was successfully implanted. |
|
2023-02-02 05:51:08 |
|
Using additionally compromised, legitimate administrative credentials, APT actors logged into the Outlook Web Application (OWA) server from the ServiceDesk system. The actors dropped an Active Server Pages Extended (ASPX) web shell in the following file system location, which was designed to execute remote JavaScript code [T1059.007] on the OWA server [T1505.003]:
Note: The administrative user’s credentials were obtained from the APT actors’ collection (LSASS dump) of credentials from the entire AD domain. This user is separate from the actor-created See MAR-10430311-1.v1 for additional details. |
|
2023-02-02 18:45:58 |
Metasploit service installed. |
APT actors installed Metasploit with the following attributes on the organization’s domain controller [T1059.001]:
Note: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform several actions, including discovery of information and execution of code. |
|
2023-02-03 03:27:59 |
|
APT actors dropped an additional ASPX web shell on a web server in the following file system location:
See MAR-10430311-1.v1 for additional details. |
|
2023-02-03 15:12:23 |
|
APT actors created and used a variant of Metasploit (Meterpreter) on the ServiceDesk system, listed as See MAR-10430311-1.v1 for additional details. |
|
2023-02-08 08:56:35, 2023-02-09 20:19:59, 2023-03-04, 2023-03-18 |
Hypertext Preprocessor (PHP) files uploaded via HTTP-POST request from malicious IP |
PHP files were uploaded to the ServiceDesk system via HTTP-POST request. APT actors were observed writing 16 instances of the following files to disk:
|
|
2023-03-06 06:49:40 |
|
APT actors executed Domain Name System (DNS) scanning at an additional server (not the ServiceDesk system) and directed callback to the Destination IP: |
Post-engagement analysis was extended but analysts were unable to determine additional actions taken by the APT actors, likely due to a lack of sensor coverage and data unavailability. With the data available, it was determined APT actors used the tools listed in Table 2 during their operations.
|
Tool |
Description |
Observation |
|---|---|---|
|
Mimikatz [2] |
A credential dumping tool capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. |
In addition to using Mimikatz for credential dumping, APT actors dumped the following Windows Registry Hive files:
These files were dumped to obtain registry information such as users on the system, data used by the operating system [T1012], and installed programs. |
|
Ngrok [3] |
Ngrok software operates by running a client process on the machine and creating a private connection tunnel to a designated open port. Ngrok delivers instant ingress to applications in any cloud, private network, or devices with authentication, load balancing, and other critical controls. In recent years, Ngrok has been leveraged maliciously by a variety of threat actors, including use for persistence, lateral movement, and data exfiltration.[4],[5],[6] |
Using Ngrok as an external service, APT actors were able to gain access to and utilize the command line on victim systems. Note: CISA and co-sealers have observed this commonly used commercial platform being abused by malicious actors to bypass typical firewall controls. Ngrok’s ability to tunnel RDP and other services securely over internet connections makes it a target for abuse by malicious actors. |
|
ProcDump |
A command-line application used to monitor processes and create crash dump files. A crash dump file contains the data loaded in memory at the time the dump was triggered. It is typically used for troubleshooting errors with an application or operating system. |
APT actors used ProcDump to conduct reconnaissance and examine spawned processes (applications in use). This tool was also utilized as a utility for dumping credentials from the server hosting ServiceDesk Plus. |
|
Metasploit |
Metasploit is an open-source penetration testing software. |
APT actors’ specific use of Meterpreter—an attack payload of Metasploit—serves as an interactive shell and allows threat actors to control and execute code on a system. |
|
Interact.sh |
An open-source tool for detecting external interactions (communication).[7] This tool is used to detect callbacks from target systems for specified vulnerabilities and commonly used during the reconnaissance stages of adversary activity. |
APT actors likely used |
|
anydesk.exe |
A remote desktop application that provides platform-independent remote access to personal computers and other devices running the host application. It offers remote control, file transfer, and VPN functionality. |
Between early-February and mid-March 2023,
Note: Analysts confirmed APT actors’ weaponized use of |
|
quser.exe |
