Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure
blog.eclecticiq.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution
CVEs this report names
5 CVEs- CVE-2021-44228Apache Log4j2 Remote Code Execution VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports>99.9%Top 0.01%90.0priority
- CVE-2021-3129Laravel Ignition File Upload VulnerabilityLaravel · IgnitionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report99.9%Top 0.03%83.7priority
- CVE-2020-2551Oracle Fusion Middleware Unspecified VulnerabilityOracle · Fusion MiddlewareKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1210Exploitation of Remote Services1 report92.8%Top 0.17%73.7priority
- CVE-2023-21839Oracle WebLogic Server Unspecified VulnerabilityOracle · WebLogic ServerKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1005Data from Local System1 report99.9%Top 0.03%72.1priority
- CVE-2022-39197Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability44.1%Top 1.2%70.9priority
Where it names them
CVE-2021-44228 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:• CVE-2023-21839 Oracle WebLogic Server RCE• CVE-2021-3129 Laravel debug mode RCE• CVE-2020-2551 Oracle WebLogic RCE• CVE-2021-44228 Apache Log4j
“NVD - CVE-2021-44228.”
https://nvd.nist.gov/vuln/detail/CVE-2021-44228 (accessed Apr.
CVE-2021-3129 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:• CVE-2023-21839 Oracle WebLogic Server RCE• CVE-2021-3129 Laravel debug mode RCE• CVE-2020-2551 Oracle WebLogic RCE• CVE-2021-44228 Apache Log4j
“NVD - CVE-2021-3129.”
https://nvd.nist.gov/vuln/detail/CVE-2021-3129 (accessed Apr.
CVE-2020-2551 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:• CVE-2023-21839 Oracle WebLogic Server RCE• CVE-2021-3129 Laravel debug mode RCE• CVE-2020-2551 Oracle WebLogic RCE• CVE-2021-44228 Apache Log4j
“NVD - CVE-2020-2551.”
https://nvd.nist.gov/vuln/detail/CVE-2020-2551 (accessed Apr.
CVE-2023-21839 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
observed that the threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:• CVE-2023-21839 Oracle WebLogic Server RCE• CVE-2021-3129 Laravel debug mode RCE• CVE-2020-2551 Oracle WebLogic RCE•
“NVD - CVE-2023-21839.”
https://nvd.nist.gov/vuln/detail/CVE-2023-21839 (accessed Apr.
CVE-2022-39197 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Patch for publicly available Cobalt Strike vulnerability tracked as CVE-2022-39197.Figure 8 shows a small portion of Cobalt Strike Cat logs from the attacker´s infrastructure.
“NVD - CVE-2022-39197.”
https://nvd.nist.gov/vuln/detail/CVE-2022-39197 (accessed Apr.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.