APT41 Using New Speculoos Backdoor to Target Organizations Globally
Summary: Unit 42 obtained five samples of a FreeBSD-compiled backdoor it named Speculoos, delivered by exploiting CVE-2019-19781 in Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliances, with the first wave running from January 31 to February 1, 2020 and a second on February 24, 2020. Victims spanned healthcare, higher education, manufacturing, government, and technology services across North America, South America, and Europe, and the payload beacons over TCP/443 to alibaba.zzux[.]com with a backup C2 at 119.28.139[.]20.
Key Takeaway: Because all or a significant amount of network traffic must traverse these appliances, APT41 could monitor or modify an entire organization's activity rather than a single host, and these black-box devices are rarely inspected for anomalous behavior.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-19781
- Related
- CVE-2019-19781: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021