Msiexec Impersonation – Exploit Leads to Data Exfiltration

The intrusion began with the exploitation of an internet-facing instance of ManageEngine SupportCenter Plus via the CVE-2021-44077 vulnerability.
The threat actor successfully exploited the RCE vulnerability in SupportCenter Plus, which allowed them to drop a web shell in an internet accessible directory.
The exploit that was witnessed looks very similar to a publicly available POC exploit on GitHub.

The threat actor then performed some generic enumeration of the system and enabled WDigest authentication on the server using the web shell.
Enumeration on the system included querying network configuration, a list of domain joined computers, user and OS information, and current user sessions on the beachhead.

Periodically over several days, the threat actor returned and checked what users were logged into the beachhead server using the webshell.
Finally, on the seventh day, the threat actors performed an LSASS dump on the system, which captured the credentials of an administrative user that had recently logged into the system.
In this case, the threat actor had access to the user’s plaintext credentials as a result of WDigest authentication being previously enabled.

The following day the threat actor downloaded ekern.exe, which was a renamed version of Plink, and deployed a script to establish a reverse SSH connection to the RDP port of the beachhead server.
An interactive RDP session was successfully established to the beachhead server by the threat actor where they began enumerating other computers on the network.

From the beachhead, lateral movement was conducted to three other servers via RDP, including a domain controller, a file server, and another server.
Confidential files were exfiltrated from the network throughout this intrusion using a mixture of web shell access and hands-on keyboard access via RDP.

These files, were critical to the business and it’s partner.
The documents were selectively chosen as if the attackers were looking for specific material.
When it came time to exfiltrate certain files or folders, one folder of the utmost importance was exfiltrated while passing on other partner folders and files.

Besides the files and folders mentioned, internal machine certs were reviewed and later exfiltrated.
The exfiltrated information has not been found in any public dumps or sales to date.

The threat actors were evicted from the network soon after stealing this information.

Sign Up For Threat Alerts

Threats Icon

Jun 30, 2022

YTStealer Malware: YouTube Cookies! Om Nom Nom...

The Dark Web Market for YouTube Account Access In 2006, the term "data is the...

Threats Icon

Jun 27, 2022

Bronze starlight Ransomware Operations Use HUI Loader

The BRONZE RIVERSIDE threat group is likely responsible for stealing intellectual property from Japanese organizations....

Threats Icon

Jun 27, 2022

The Black Basta ransomware is a new...

Although active for just two months, the group already rose to prominence claiming attribution of...

Threats Icon

Jun 27, 2022

Gallium APT Group

Researchers from Palo Alto Networks defined the PingPull RAT as a "difficult-to-detect" backdoor that leverages...

Threats Icon

Jun 26, 2022

US Cert Alert – Malicious Cyber Actors...

The Cybersecurity and Infrastructure Security Agency (CISA) and United States Coast Guard Cyber Command (CGCYBER)...

Threats Icon

Jun 23, 2022

Matanbuchus: Malware-as-a-Service with Demonic Intentions

A new malware-as-a-service (MaaS) called Matanbuchus Loader was discovered in underground markets by Unit42. Malware...

Threats Icon

Jun 22, 2022

Websites Hosting Fake Cracks Spread Updated CopperStealer...

Analysts noticed a new version of CopperStealer and analyzed these samples to be related to...

Threats Icon

Jun 21, 2022

Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect...

Symbiote is a shared object (SO) library that is loaded into all running processes using...

Threats Icon

Jun 19, 2022

HelloXD Ransomware Installing Backdoor on Targeted Systems

Systems are being targeted by a ransomware variant called HelloXD, with the infections also involving...

Threats Icon

Jun 16, 2022

Panchan’s Mining Rig: New Golang Peer-to-Peer Botnet

Akamai security researchers discovered Panchan, a new peer-to-peer botnet and SSH worm that emerged in...

Threats Icon

Jun 15, 2022

PureCrypter: A Fully-Functional Loader Distributing Remote Access...

PureCrypter is a fully-featured loader being widely sold The malware has been observed distributing a...

Threats Icon

Jun 14, 2022

CERT-IL Alert: an active phishing campaign in...

Recently new information was passed to the CERT-IL team indicating that there is an active...

Threats Icon

Jun 13, 2022

Follina suspected state aligned phishing campaign

Proofpoint blocked a suspected state aligned phishing campaign targeting European gov & local US gov...

Threats Icon

Jun 09, 2022

Newly-Discovered Chinese-linked APT Has Been Quietly Spying...

Cado Labs regularly analyses attacks targeting services running within a honeypot infrastructure. One recent attack...

Threats Icon

Jun 08, 2022

Active Exploitation of Confluence CVE-2022-26134

Atlassian published a security advisory for CVE-2022-26134, a critical unauthenticated remote code execution vulnerability in...