Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

xHunt Campaign: New Bumble Bee Webshell and SSH Tunnels Used for Lateral Movement

Summary: Unit 42 investigated a compromised Microsoft Exchange server at a Kuwaiti organization and found a new webshell it calls BumbleBee, which the actor used to upload and download files and run commands to discover and move laterally to other servers. The actor reached internet-facing BumbleBee instances through Private Internet Access VPNs, rotating exit IPs across Belgium, Germany, Ireland, Italy, Luxembourg, the Netherlands, Poland, Portugal, Sweden and the United Kingdom, and used Plink SSH tunnels to reach internal IIS servers at three Kuwaiti organizations.

What you should know: The actor searched the compromised mailbox for helpdesk messages and Symantec and FortiWeb alert emails, so the organization's own security notifications were being read by the intruder. The SSH tunnel credentials bor and 123321 matched a cheat sheet in the Sakabota tool from prior xHunt activity, tying this intrusion to an established campaign.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related