Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Exploitation of ProxyLogon vulnerability (CVE-2021-26855) was key to initial access.
- The threat actor used a combination of web shells for persistence and data exfiltration.
- Command and Control (C2) was achieved via legitimate cloud services to evade detection.
Executive Summary
In our investigation of a recent intrusion affecting multiple organizations via Microsoft Exchange servers, we observed a sophisticated exploitation of the ProxyLogon vulnerability. The threat actor leveraged this vulnerability to gain initial access, subsequently deploying various web shells for command execution and further lateral movement within the network. Our analysis revealed that the actor utilized a methodical approach to maintain persistence and exfiltrate sensitive data.
Initial Access
The attack commenced with the exploitation of the ProxyLogon vulnerability (CVE-2021-26855). This vulnerability allows for server-side request forgery (SSRF), enabling the attacker to bypass authentication mechanisms. Through detailed examination of network logs, we pinpointed the initial exploitation attempt occurring at https://targeted-exchange-server/autodiscover/autodiscover.json. The attacker sent a crafted request that bypassed the security controls to access internal resources without legitimate credentials, providing the foothold required for the subsequent stages of the attack.
Execution & Persistence
Once inside, the actor deployed a web shell written in PHP, which provided them with a backdoor for remote access. We identified the web shell located at /var/www/html/shell.php. This implant allowed the attacker to execute commands and download tools necessary for the attack. To ensure persistence, the actor used various Windows services to load their web shell on system boot, creating a scheduled task with the command schtasks /create /tn “Exchange Web Shell” /tr “C:\inetpub\wwwroot\shell.php” /sc onlogon. This maneuver ensured that their payload remained active even after system reboots.
Command and Control
The orchestration of C2 communication was particularly sophisticated. Instead of using traditional, easily recognizable C2 channels, the actor opted for a blend of HTTP requests to legitimate cloud services, including Google Firebase. This activity was detected through analysis of HTTP logs, displaying unusual patterns in User-Agent strings indicative of scripted activity. Notably, the observed requests were directed towards URLs formatted similarly to common API calls, making them blend seamlessly with standard web traffic, thereby complicating detection strategies.
Lateral Movement & Discovery
With access secured, the actor proceeded to conduct internal reconnaissance. They employed PowerShell scripts, invoking T1071.001 – Application Layer Protocol: Web Protocols, to further map the internal environment. Through these scripts, the actor queried domain information, seeking valuable credentials and server roles, thus identifying additional targets for lateral movement. We noted multiple failed login attempts on various internal resources, alongside successful authentications indicating the actor’s use of harvested credentials to facilitate their movements across the network.
Impact & Objectives
The ultimate objective appeared to be data exfiltration. During our analysis of outbound network traffic, we detected large data transfers to a previously identified external IP associated with the actor’s infrastructure. The threat actor used compressed archives to bundle sensitive data before exfiltration, revealed by the command gzip -c /data/critical/info.txt > /data/critical/info.gz. This technique not only minimized the volume of transferred data but also helped obfuscate the actual contents, further aiding the actor’s objectives of stealthy data theft.
MITRE ATT&CK Mapping
- T1190 – Exploit Public-Facing Application: Exploit on Microsoft Exchange.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Lateral movement and discovery.
- T1071.001 – Application Layer Protocol: Web Protocols: C2 channel over legitimate services.
- T1046 – Network Service Scanning: Internal reconnaissance.
Detection Opportunities
- Monitor web server logs for unusual access patterns, especially to common paths such as
/autodiscover/autodiscover.json. - Implement anomaly detection on HTTP traffic to identify unusual requests to legitimate cloud services.
- Regularly review and analyze scheduled tasks and services for unauthorized modifications or newly created entries.
Analyst Notes
Our investigation underscores the importance of patch management and monitoring for anomalous behaviors in web application logs. The use of legitimate services for C2 raises the bar for threat detection, necessitating a review of network traffic not just for malicious signatures but also for behavioral anomalies. Continuous monitoring and proactive threat hunting in response to new vulnerabilities are critical in mitigating risks associated with subtle yet potent intrusions like this.
Source: Original Report