Log4U, Shell4Me

The BlackBerry Research & Intelligence and Incident Response (IR) teams have found evidence correlating attacks by the Initial Access Broker (IAB) group Prophet Spider with exploitation of the Log4j vulnerability in VMware Horizon. This article highlights the recent indicators of compromise (IoCs) that we’ve observed.

Defenders concerned that they may have been a victim of these attacks can make use of these IoCs and detection methods to identify evidence of compromise within their environment.

What is Log4Shell?

“Log4Shell” is a moniker used to refer to a combination of remote code execution (RCE) vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832) identified in Apache Log4j, a logging framework based on Java which is incorporated into Apache web servers all over the world. Due to Log4j’s popularity in many applications (including VMware), combined with the severity of the exploit, security teams were recently left scrambling in the wake of widespread exploitation of this new attack vector.

The exact number of applications (and the various versions) affected by these vulnerabilities may never be fully known. Although VMware released a patch and mitigation guidance in December 2021 in response to the vulnerability, many implementations remain unpatched, leaving them susceptible to exploitation.

Initial Detection

BlackBerry researchers have observed that the exploit could be reliably detected by monitoring child processes of the ws_TomcatService.exe parent process, as this is the same Tomcat service used by VMware Horizon. In all observed cases, exploitation of the ws_TomcatService.exe process spawned either cmd.exe or powershell.exe as child processes.

Figure 1: Parent and child process relationship

Post Exploitation Activity

Upon exploiting the vulnerability, threat actors most commonly used encoded PowerShell commands to download a second-stage payload to the victimized systems. The specifics of that payload depend on the attacker’s motives and goals; for example, cryptomining, or ransomware and extortion.

While BlackBerry primarily observed the threat actors installing cryptocurrency mining software on the affected systems, Cobalt Strike beacons were also discovered in some instances.

Encoding Examples

Once decoded, the resulting code used one of two methods to download the second-stage payload. The first and more common method was the use of PowerShell’s System.Net.Webclient class, along with the DownloadString, DownloadData, or DownloadFile methods.

Typical Download Cradle

Alternatively, there were also cases where the threat actor attempted to use the curl.exe binary file to download additional files to the system. The attacker then attempted to execute the downloaded content using the Windows Subsystem for Linux (WSL) bash utility.

Curl Download Attempt

BlackBerry threat researchers identified multiple different cryptocurrency miners that were deployed after successful exploitation by threat actors. One example used Powershell to download and execute the “xms.ps1” file containing the cryptominer.

Cryptocurrency Miner Download Example

The script then created a Scheduled Task, which was used to establish persistence, as well as for storing command-and-control (C2) and wallet configurations.

Scheduled Task Creation

We also discovered instances where a webshell file was injected into absg-worker.js and the VMBlastSG service restarted to allow for connections to the webshell, as described in this warning posted by the National Health Service for the UK. Webshells are difficult to detect backdoors that threat actors use to maintain stealthy persistence in a victim’s environment.

To accomplish this injection, threat actors search for the file path to the VMBlastSg service, then change the file name in the path from NSSM.exe to absg-worker.js. Next, the content of the absj-worker.js file is modified to force the creation of a child process when the file is called via a browser. Then the VMBlastSG service is restarted, and the webshell is available to the attacker.

Webshell Creation

BlackBerry researchers observed several instances of cleanup actions taken by threat actors following the miner installation, to help cover their tracks. (After all, everyone appreciates a tidy and thoughtful threat actor!)

Cleanup Examples

In additional instances of post-exploitation deployment, the threat actor downloaded and installed a Cobalt Strike beacon to the infected systems.

Cobalt Strike Download Cradle

We were able to retrieve a copy of the Cobalt Strike configuration, which indicated that successful execution of the Cobalt Strike beacon would spawn either a 32- or 64-bit version of rundll32.exe containing the beacon payload. The following User-Agent string was hard-coded into the beacon configuration.

Cobalt Strike Beacon User-Agent String

Prophet Spider Commonalities

In addition to the mass deployment of cryptocurrency mining software and Cobalt Strike beacons, BlackBerry researchers also discovered an instance of exploitation containing tactics, techniques, and procedures (TTPs) relating to the Prophet Spider IAB. This threat group is known to compromise networks and later sell access to ransomware operators. We discussed a similar group called Zebra2104 in our recent report, “Hunter Becomes Hunted: Zebra2104 Hides a Herd of Malware.”

One of the indicators that helped us attribute the event to this threat group was their use of the C:\Windows\Temp\7fde\ folder path to store malicious files. The threat actor also downloaded a copy of the wget.bin executable, which has historically been used by the group to get additional files onto infected hosts. The IP used in the download cradle has also been previously attributed to the Prophet Spider group.

wget.bin Download

After downloading the wget.bin executable, the file was then used to download two additional executables named ve.bin and winntaa.exe.

Additional Payloads

Next, the attacker began their attempts to enumerate basic information about the network and domain.

Enumeration

Lastly, the threat actor attempted to harvest credentials from the registry.

Credential Harvesting

Steps to Mitigation

Says Tony Lee, Vice President of Global Services Technical Operations at BlackBerry, "If an organization can pay a ransom or can be turned into a cryptomining farm, they can expect to be a target. (Read: Nearly every organization.) The simple answer for mitigating steps is to patch all vulnerable instances of Log4j, along with all other vulnerabilities – however, it is never that simple."

Lee continues: "While a robust vulnerability management program is an absolute must, it is not the only solution. A layered defense that includes 24x7 monitoring, threat intel overlay, threat hunting, and AI-based endpoint protection helps in quickly identifying and mitigating breaches. The faster a compromise such as this is detected and mitigated, the better the chance of dodging the follow-on ransomware attack."

Conclusion

When an initial access broker group takes interest in a vulnerability whose scope may never be known, this gives us a good indication that they see significant value in its exploitation. It’s likely that we will continue to see criminal groups exploring the opportunities of the Log4Shell vulnerability in the near future, as IT teams and users continue to scramble to address these vulnerabilities.

As this situation unfolds and we discover new information, BlackBerry threat researchers will continue to provide intelligence and guidance to help defenders protect against threats that take advantage of the situation.

Indicators of Compromise (IoCs)

Decoded PowerShell Events

Victim of an Attack?

If you believe you have already been the victim of an attack, please contact us, regardless of your existing BlackBerry relationship.

The BlackBerry Incident Response team is made up of world-class consultants dedicated to handling response and containment services for a wide range of incidents, including ransomware and Advanced Persistent Threat (APT) cases.