The embedded executable used in this attack has inbound and outbound communications encrypted with a 128-bit key. When this occurs, two *.tmp files are written to the disk location to attempt to connect to the hard-coded C2 server, over a non-standard port, 4443. The Windows loader, hmsvc, first creates a Scheduled Task, which will execute the malware every hour. Attackers could also use the malware as a C2 tunnelling proxy, which allowed them to mover further into the network and pivot to other systems. These included the ability to log keystrokes, providing GUI access over a target Window’s system desktop, and attackers could upload and execute additional payloads. The embedded executable in this attack was a remote access tool that allowed for a range of C2 (Command & Control) capabilities. This was found to be running at the highest possible privilege level on a Windows system, but it is currently unknown how the attackers successfully caused this elevation of privilege. In one instance, the malicious code contained a modified version of a legitimate Microsoft Windows service: SysInternals LogonSessions software.

Two related case studies of confirmed compromises resulting from this vulnerability being exploited were detailed in last week’s alert. CISA have advised that all organisations in this position treat their VMware systems as if they have been compromised and activate an incident response procedure immediately.

This is an ongoing issue, and many organisations have still not yet updated their VMware Horizon or Unified Access Gateway (UAG) devices, and running unpatched systems, exposing them to this threat. VMware strongly urged their customers in January to secure their internet facing VMware Horizon servers as they were aware that some companies had not been patched. Log4Shell gives attackers the opportunity to implant loader malware onto compromised systems, which contains executables, allowing for a range of remote C2 capabilities. First disclosed in December 2021, this vulnerability was tagged 10/10 critical by NIST, but as the recent security advisory explains, this is continuing to be exploited to provide attackers with initial access to networks. Log4Shell affects Apache Log4j2 2.0-beta9 through to version 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1). This vulnerability is commonly known as Log4j, or Log4Shell because it gives attackers a shell that allows them to remotely access internet facing Log4j devices.

The Cybersecurity and Infrastructure Security Agency (CISA) and United States Coast Guard Cyber Command (CGCYBER) released a joint security advisory last week to warn of the active exploitation of CVE-2021-44228.

Windows loader 2.3.1