Frame-14

Privacy Ninja

        • DATA PROTECTION

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Iranian Hackers Target VMware Horizon Servers with Log4j Exploits

Iranian Hackers Target VMware Horizon Servers with Log4j Exploits

An Iranian-aligned hacking group tracked as TunnelVision was spotted exploiting Log4j on VMware Horizon servers to breach corporate networks in the Middle East and the United States.

Security analysts at SentinelLabs who have been tracking the activity chose that name due to the group’s heavy reliance on tunneling tools, which help them hide their activities from detecting solutions.

Tunneling is the process of routing data traffic in such a way that its transmission becomes obfuscated or even hidden.

The ultimate goal of TunnelVision appears to be the deployment of ransomware, so the group is not focused on cyber espionage alone but data destruction and operational disturbance too.

Also Read: Data Protection Trustmark Certification: Business Advantage

Target flaws

TunnelVision has previously targeted CVE-2018-13379 (Fortinet FortiOS), a Microsoft Exchange ProxyShell vulnerability set, and has now turned to the Log4Shell exploit.

The target deployments are VMware Horizon servers vulnerable to the easy-to-exploit Log4j flaws.

The exploitation process is the same as what the NHS detailed in a January 2022 security bulletin, which involves the direct execution of PowerShell commands and the activation of reverse shells via the Tomcat service.

The PowerShell commands help the adversaries in retrieving outputs using a webhook, while all connections employ one of the following legitimate services:

  • transfer.sh
  • pastebin.com
  • webhook.site
  • ufile.io
  • raw.githubusercontent.com
Downloading ngrok to a compromised VMware server
Downloading ngrok to a compromised VMware server (Sentinel Labs)

Backdoors

SentinelLabs observed TunnelVision dropping two custom reverse shell backdoors onto compromised machines.

Also Read: Data Anonymisation: Managing Personal Data Protection Risk

The first payload is a zip file that contains an executable named “InteropServices.exe,” which contains an obfuscated reverse shell beaconing to “microsoft-updateserver[.]cf.”

The second payload, which was predominately used by the threat actors in recent attacks, is a modified version of a one-liner PowerShell available on GitHub.

Second reverse-shell used in most attacks
Second reverse-shell used in most attacks (Sentinel Labs)

TunnelVision relies on this second backdoor to perform the following actions:

  • Execute recon commands.
  • Create backdoor users and add them to the administrators’ group.
  • Credential harvesting using Procdump, SAM hive dumps, and comsvcs MiniDump.
  • Download and execute tunneling tools, including Plink and Ngrok, used to tunnel RDP traffic.
  • Execution of a reverse shell utilizing VMware Horizon NodeJS component.
  • Perform RDP scans on the internal subnet using a publicly available port scan script.

A distinct cluster 

While TunnelVision has some similarities and overlaps with other Iranian hacking groups, SentinelLabs attributes the activity to a separate and distinct cluster.

“TunnelVision activities have been discussed previously and are tracked by other vendors under a variety of names, such as Phosphorus (Microsoft) and, confusingly, either Charming Kitten or Nemesis Kitten (CrowdStrike),” explains the SentinelLabs report

“This confusion arises since activity that Microsoft recognizes as a single group, “Phosphorous”, overlaps with activity that CrowdStrike distinguishes as belonging to two different actors, Charming Kitten and Nemesis Kitten.”

As the analysts conclude, the possibility for a relationship between these groups cannot be excluded, but there’s no sufficient evidence that points to any links at this time.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us