Iran-linked threat actors used a Log4Shell vulnerability to compromise a Federal Civilian Executive Branch (FCEB) organization and installed XMRig crypto-mining malware, according to a joint alert issued by the FBI and CISA.
The attackers gained access to the federal network after hacking into an unpatched VMware Horizon server and exploiting a remote code execution vulnerability in Log4Shell (CVE-2021-44228).
“CISA obtained four malicious files for analysis during an on-site incident response engagement at a Federal Civilian Executive Branch (FCEB) organization compromised by Iranian government sponsored advanced persistent threat (APT) actors. These files have been identified as variants of the XMRIG cryptocurrency mining software. The files include a kernel driver, two Windows executables, and a configuration file to control one of the executable’s behaviors on the network and infected host.”, according to the report
After installing the XMRig crypto miner, the attackers executed lateral movement to access the domain controller (DC), obtained credentials, and then placed Ngrok reverse proxies on a number of hosts to sustain persistence within the FCEB agency’s network.
“From mid-June through mid-July 2022, CISA conducted an onsite incident response engagement and determined that the organization was compromised as early as February 2022, by likely Iranian government-sponsored APT actors who installed XMRig crypto mining software. The threat actors also moved laterally to the domain controller, compromised credentials, and implanted Ngrok reverse proxies.” added the advisory
In the advisory, the agencies also advised organizations that haven’t yet patched their VMware systems against Log4Shell should assume they have already been infiltrated and initiate threat-hunting activities by looking for malicious activity within their networks.
‘They encourage organizations to look for threat actors moving laterally, look at linked systems (including the DC), and audit privileged accounts. All organizations should implement the provided recommendations to safeguard against such malicious cyber activities and behavior, regardless of identified evidence of compromise.’
The recommended mitigations include:
In June 2022, CISA issued a warning about the continued use of Log4Shell vulnerabilities by a variety of threat actors, including state-sponsored hacker groups, to attack VMware Horizon and Unified Access Gateway (UAG) servers.
Log4Shell can be remotely exploited to target vulnerable servers with local or Internet access, allowing attackers to move laterally across infiltrated networks and access internal systems containing sensitive data.