Snynet Solution Logo
MON - SUN: 10 AM - 6 PM
+60 11 5624 8319

Blog

More clues appear to link Supernova web shell activity to Chinese hackers

Image Description

Researchers from the Counter Threat Unit (CTU) at Secureworks have discovered a possible link to China while examining how SolarWinds servers were used to deploy malware.

During the end of last year, a compromised internet-facing SolarWinds server was used as a springboard by hackers to deploy the .NET web shell Supernova. Based on similar intrusions which occurred on the same network, it appears that the Chinese-based Spiral threat group is responsible for both cases.

According to Secureworks' new report, the authentication bypass vulnerability in SolarWinds Orion API, tracked as CVE-2020-10148, that can lead to remote execution of API commands, has been actively exploited by Spiral. When vulnerable servers are detected and exploited, a script capable of writing the Supernova web shell to disk is deployed using a PowerShell command.

Supernova, which is written in .NET, is an advanced web shell that can maintain persistence on a compromised machine as well as compile “method, arguments and code data” in-memory according to a post from Palo Alto Network's Unit 42.

Supernova

During an incident observed by Secureworks that occurred last August, Supernova was used by Spiral to perform reconnaissance, domain mapping and to steal both credentials and information from a ManageEngine ServiceDesk server. This incident shares similarities to the one that occurred in November and was analyzed by the firm's Counter Threat Unit.

While these two cases are believed to be the work of the Spiral threat group, there is no link to the SolarWinds hack that occurred in December of last year.

To prevent falling victim to future attacks by Spiral, Secureworks recommends that organizations use available controls to restrict access to several IP addresses (which can be found here) that point to the threat group's C&C servers.

Via ZDNet

Date

09 Mar 2021

Sources


Share


Other Blog

  • 5 new films and series to watch this weekend on Indian OTT platforms

    These are the new releases on Amazon Prime Video, Netflix, Disney+ Hotstar and other OTT platforms in India.

    Read More
  • Motorola is once again trying to make your phone into a PC

    A decade after the Atrix 4G Laptop Dock, Motorola is once again trying its luck with a smartphone that can act as a PC.

    Read More
  • The most powerful laptop in the world has disappeared - here’s what happened

    It’s all a matter of firmware updates, it seems.

    Read More
  • Facebook Workplace wants to make collaboration more enjoyable

    Video improvements, better third-party integration and more coming to Facebook Workplace.

    Read More

Find Out More About Us

Want to hire best people for your project? Look no further you came to the right place!

Contact Us