Unmasking the new persistent attacks on Japan
Summary: Cisco Talos found an attacker predominantly targeting organizations in Japan across technology, telecommunications, entertainment, education, and e-commerce, gaining initial access by exploiting CVE-2024-4577, a remote code execution flaw in Windows PHP-CGI setups, using a publicly available Python exploit script. After exploitation the attacker ran PowerShell to load Cobalt Strike reverse HTTP shellcode, escalated to SYSTEM with JuicyPotato, RottenPotato, and SweetPotato, established persistence through registry keys, scheduled tasks, and services via the "TaoWu" Cobalt Strike kit, cleared Windows event logs with wevtutil, moved laterally with fscan.exe and SharpGPOAbuse.exe, and dumped passwords and NTLM hashes with Mimikatz.
Key Takeaway: The attacker left the root folder of one C2 server, 38[.]14[.]255[.]23 hosted on Alibaba Cloud, openly listable on the internet, exposing PowerShell scripts, beacon executables, and command history - and the same intrusion used a pre-configured installer from a Chinese security training repository that pulls offensive frameworks including Viper C2, BeEF, and Blue-Lotus as Docker containers.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-4577
- Related
- CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 12, 2024