Rewterz Threat Update – Iran-linked Threat Actors Compromise US Government Network

Severity

High

Analysis Summary

Iran-linked threat actors used a Log4Shell vulnerability to compromise a Federal Civilian Executive Branch (FCEB) organization and installed XMRig crypto-mining malware, according to a joint alert issued by the FBI and CISA.

The attackers gained access to the federal network after hacking into an unpatched VMware Horizon server and exploiting a remote code execution vulnerability in Log4Shell (CVE-2021-44228).

“CISA obtained four malicious files for analysis during an on-site incident response engagement at a Federal Civilian Executive Branch (FCEB) organization compromised by Iranian government sponsored advanced persistent threat (APT) actors. These files have been identified as variants of the XMRIG cryptocurrency mining software. The files include a kernel driver, two Windows executables, and a configuration file to control one of the executable’s behaviors on the network and infected host.”, according to the report

After installing the XMRig crypto miner, the attackers executed lateral movement to access the domain controller (DC), obtained credentials, and then placed Ngrok reverse proxies on a number of hosts to sustain persistence within the FCEB agency’s network.

“From mid-June through mid-July 2022, CISA conducted an onsite incident response engagement and determined that the organization was compromised as early as February 2022, by likely Iranian government-sponsored APT actors who installed XMRig crypto mining software. The threat actors also moved laterally to the domain controller, compromised credentials, and implanted Ngrok reverse proxies.” added the advisory

In the advisory, the agencies also advised organizations that haven’t yet patched their VMware systems against Log4Shell should assume they have already been infiltrated and initiate threat-hunting activities by looking for malicious activity within their networks.

‘They encourage organizations to look for threat actors moving laterally, look at linked systems (including the DC), and audit privileged accounts. All organizations should implement the provided recommendations to safeguard against such malicious cyber activities and behavior, regardless of identified evidence of compromise.’

The recommended mitigations include:

• Install the most recent (updated) builds to ensure that the impacted UAG and VMware Horizon systems are updated.
• Patch and upgrade any platforms and software timely. Prioritize patching known exploited vulnerabilities and zero-days.
• Minimize your organization’s internet-facing attack surface
• Utilize best practices for identity and access management (IAM) in accordance with phishing-resistant multifactor authentication (MFA)
• Audit domain controllers
• Examine your current security measures against the ATT&CK methodologies listed in the joint advisory.

In June 2022, CISA issued a warning about the continued use of Log4Shell vulnerabilities by a variety of threat actors, including state-sponsored hacker groups, to attack VMware Horizon and Unified Access Gateway (UAG) servers.

Log4Shell can be remotely exploited to target vulnerable servers with local or Internet access, allowing attackers to move laterally across infiltrated networks and access internal systems containing sensitive data. 

Impact

• Remote Code Execution

Remediation

• Install the most recent (updated) builds to ensure that the impacted UAG and VMware Horizon systems are updated.
• Utilize best practices for identity and access management (IAM) in accordance with phishing-resistant multifactor authentication (MFA)
• Examine your current security measures against the ATT&CK methodologies listed in the joint advisory.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Maintain daily backups of all computer networks and servers.