Iranian state-sponsored actors are leaving no stone unturned to take advantage of unpatched programs working Log4j to focus on Israeli entities, indicating the vulnerability’s lengthy tail for remediation.
Microsoft attributed the newest set of actions to the umbrella menace group tracked as MuddyWater (aka Cobalt Ulster, Mercury, Seedworm, or Static Kitten), which is linked to the Iranian intelligence equipment, the Ministry of Intelligence and Safety (MOIS).
The assaults are notable for utilizing SysAid Server situations unsecured towards the Log4Shell flaw as a vector for preliminary entry, marking a departure from the actors’ sample of leveraging VMware functions for breaching goal environments.
“After gaining entry, Mercury establishes persistence, dumps credentials, and strikes laterally inside the focused group utilizing each customized and well-known hacking instruments, in addition to built-in working system instruments for its hands-on-keyboard assault,” Microsoft stated.
The tech large’s menace intelligence workforce stated it noticed the assaults between July 23 and 25, 2022.
A profitable compromise is alleged to have been adopted by the deployment of internet shells to execute instructions that let the actor to conduct reconnaissance, set up persistence, steal credentials, and facilitate lateral motion.
Additionally employed for command-and-control (C2) communication throughout intrusions is a distant monitoring and administration software program known as eHorus and Ligolo, a reverse-tunneling instrument of alternative for the adversary.
The findings come because the U.S. Division of Homeland Safety’s Cyber Security Assessment Board (CSRB) deemed the essential vulnerability within the open-source Java-based logging framework an endemic weak point that may proceed to plague organizations for years to come back as exploitation evolves.
Log4j’s huge utilization throughout many suppliers’ software program and providers means subtle adversaries like nation-state actors and commodity operators alike have opportunistically taken benefit of the vulnerability to mount a smorgasbord of assaults.
The Log4Shell assaults additionally observe a current report from Mandiant that detailed an espionage marketing campaign aimed toward Israeli delivery, authorities, power, and healthcare organizations by a probable Iranian hacking group dubbed UNC3890.
