Chinese hackers exploit Ivanti VPN flaw to deploy new malware
At least two different cyber espionage clusters suspected of being linked to China have been tracked as UNC5325 and UNC3886has been attributed to the exploitation of a security vulnerability in Ivanti Connect Secure VPN devices.
Mandiant said that UNC5325 abused CVE-2024-21893 to spread a series of new malware named LITTLELAMB.WOOLTEA, PITSTOP, PITDOG, PITJET and PITHOOK and maintain persistent access to infected devices.
Google’s Threat Intelligence firm assesses with medium confidence that UNC5325 is related to UNC3886 because the source code in LITTLELAMB.WOOLTEA and PITHOOK overlaps with malware used by the latter.
Notably, UNC3886 has a track record of exploiting zero-day flaws in Fortinet and VMware solutions to deploy various implants such as VIRTUALPITA, VIRTUALPIE, THINCRUST, and CASTLETAP.
“UNC3886 primarily targets defense industrial base, technology and telecommunications organizations located in the United States and [Asia-Pacific] region,” Mandiant researchers said.
CVE-2024-21893 is a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA, UNC5325 This is said to have occurred as early as January December 2024 19th, for a limited number of devices.
The attack chain required combining CVE-2024-21893 with a previously disclosed command injection vulnerability tracked as CVE-2024-21887 to gain unauthorized access to vulnerable devices, ultimately leading to the deployment of a new version of BUSHWALK.
Some instances also involve the misuse of legitimate Ivanti components (such as the SparkGateway plug-in) to remove additional load. These include the PITFUEL plug-in used to load a malicious shared object codenamed LITTLELAMB.WOOLTEA, which has the ability to persist across system upgrade events, patches, and factory resets.
It also acts as a backdoor, supporting command execution, file management, shell creation, SOCKS proxying, and network traffic tunneling.
Another malicious SparkGateway plugin named PITDOG was also observed, which injects a shared object named PITHOOK to persistently execute an implant named PITSTOP, which is designed to execute shell commands on infected devices. Designed for file writing and file reading.
Mandiant described the threat actors as demonstrating “a granular understanding of the devices and their ability to subvert detection throughout their campaigns” and using Living Off the Land (LotL) techniques to fly under the radar.
The cybersecurity firm said it expects “UNC5325 and other China-linked espionage actors will continue to exploit zero-day vulnerabilities and device-specific malware on network edge devices to gain and maintain access to target environments. “
Found link between Volt Typhoon and UTA0178
The disclosure comes as industrial cybersecurity firm Dragos attributes China-sponsored surveillance and purges of Voltzite, also known as Voltzite, to multiple U.S. power companies, emergency services, telecommunications providers, the defense industrial base and satellite services. Activity.
“Voltzite’s actions against U.S. power entities, telecommunications and GIS systems demonstrate a clear goal to identify vulnerabilities within the country’s critical infrastructure that could be exploited for future destructive or destructive cyber operations,” the statement read. attack.”
Volt Typhoon’s victim footprint has since expanded to include African transmission and distribution providers, with evidence linking the adversary to UTA0178, a threat actor linked to a zero-day attack in early December 2023 that exploited an Ivanti Connect Secure flaw .
This cyber espionage campaign, which relies heavily on LotL methods to evade detection, joins two other new groups exposed in 2023, Gananite and Laurionite, in conducting long-term reconnaissance and intellectual property theft operations targeting critical infrastructure and government entities.
“Voltzite uses very few tools and prefers to operate with as little floor space as possible,” explains Dragos. “Voltzite focuses on detecting evasion and long-term persistent access, and assessing intent for long-term espionage and exfiltration.”
from Tech Empire Solutions https://techempiresolutions.com/chinese-hackers-exploit-ivanti-vpn-flaw-to-deploy-new-malware/
via https://techempiresolutions.com/
from Tech Empire Solutions https://techempiresolutions.blogspot.com/2024/02/chinese-hackers-exploit-ivanti-vpn-flaw.html
via https://techempiresolutions.com/
Comments
Post a Comment