The threat actor is using the flaw to deliver Core Impact backdoor on vulnerable systems, the security vendor says.
An Iranian cyberespionage group that some vendors track as Rocket Kitten has begun exploiting a recently patched critical vulnerability in VMWare Workspace ONE Access/Identity Manager technology to deliver the Core Impact penetration testing tool on vulnerable systems.
VMWare disclosed the remote code execution vulnerability (CVE-2022-22954) on April 6, the same time it released a patch for the issue along with fixes for a total of seven other — somewhat less critical — vulnerabilities that were privately reported to the company. VMWare identified the RCE vulnerability as a server-side template injection issue that could be used for remote code execution. The software vendor assigned it a severity ranking of 9.8 on a scale of 10 because the flaw, among other things, allows attackers to gain the highest privileged access in compromised environments.
Days after the flaw was disclosed, proof-of-exploit code for it became publicly available on Twitter. Shortly thereafter, threat actors reportedly began attacking the flaw to install cryptocurrency coin miners on vulnerable servers.
Among those that began exploiting the flaw on Apr. 14 and 15 were attackers who used it to gain access to vulnerable networks and launch reverse HTTPS backdoors such as Core Impact, Cobalt Strike, and Metasploit beacons, Morphisec said in a report Monday. The tactics, techniques, and procedures of the attackers suggested a link to Rocket Kitten, the security vendor said.
“Many groups appear to be exploiting this vulnerability, but there are not many groups deploying stolen Core Impact implants,” says Michael Gorelik, CTO and head of threat research at Morphisec. “The US customer that we saw targeted here is one that has an outreach to many US customers. Unfortunately, we can’t share any more details on that currently.”
Morphisec has approached Core Security to validate the existence of the watermark within the implant, he says.
The presence of the Core Impact backdoor on the targeted network, he says, is an indication that an APT group was behind it, simply because of how rarely the backdoor has been used by others.
Ransomware Risk
Morphisec described the new vulnerability as a server-side template injection in an Apache Tomcat component of VMWare’s Workspace ONE Access/Identity Manager that allows remote commands to be executed on the hosting server. The flaw greatly heightens the risk of ransomware attacks and significant security breaches for organizations using the vulnerable technology, the security vendor said.
VMWare Workspace ONE Access was previously known as VMWare Identity Manager. The technology is designed to give enterprises a way to quickly implement multifactor authentication, single sign-on, and conditional access policies for workers attempting to access enterprise SaaS, mobile, and Web application environments. “It is an identity provider and manager,” Gorelik says. “It has access to all the organizational users and acts as access control to the environment.” Read more:https://bit.ly/3EP1OVz
You can also read this: VMware Issues Patches for Critical Flaws Affecting Carbon Black App Control