Drifting Cloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
Summary: Volexity detected anomalous activity from a customer's Sophos Firewall on March 8, 2022, and forensic analysis found a backdoor and evidence of exploitation dating to March 5, 2022. The attacker modified the legitimate SessionCheckFilter.class file to create a webshell accessed through requests to login.jsp, used the BEHINDER framework, and then modified DNS responses to hijack CMS session cookies and install a WordPress File Manager plugin.
What's compelling: The firewall was up to date and the exploited flaw was a zero-day later published as CVE-2022-1040, so patch status alone did not stop this Chinese APT group Volexity calls DriftingCloud from turning the perimeter device into a man-in-the-middle position against the organization's own websites.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2022-1040
- Related
- Attackers target Ukraine using GoMet backdoor Cyber Risks ·At The Edge Clear: March 2 – 9, 2026 Cyber Risks ·CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022