{Updated on January 24, 2022}:<\/strong> On January 19, 2022, SolarWinds issued an advisory and a fix for a vulnerability identified as CVE-2021-35247 that was being leveraged in Log4J attacks.<\/p>\n CVE-2021-35247\u00a0 is an input validation vulnerability that can, given some input, allow attackers to build a query and send it over the network without sanitation.<\/p>\n On January 22, CISA included the vulnerability and 16 others in an update to the Known Exploited Vulnerabilities Catalog, with a patch deadline for the first week of February.\u00a0<\/strong><\/p>\n We, therefore,\u00a0urge organizations to update their Serv-U servers to version 15.3 to mitigate the issue before the February deadline.<\/strong><\/p>\n<\/blockquote>\n {Updated on January 5, 2022}: <\/strong>An increase in Clop ransomware victims in the last few months was traced back to the SolarWinds Serv-U FTP vulnerability which is being abused by the threat actor, TA505.<\/p>\n The cybercrime threat actor, TA505, also known as Hive0065, uses Clop ransomware for extortion attacks. The Serv-U vulnerability was used as an initial access technique deviating from their usual tactics of a phishing-based approach.<\/p>\n We urge customers to immediately update systems running SolarWinds Serv-U software to version 15.2.3 HF2 and above.\u00a0<\/strong><\/p>\n <\/p>\n On July 9, 2021, Microsoft informed <\/a>SolarWinds of a zero-day vulnerability (CVE-2021-35211<\/a>) in its Serv-U Managed File Transfer software that was being exploited in the wild. The threat campaign was attributed to<\/a> a Chinese group called DEV-0322. Another Chinese APT group called SPIRAL was also seen targeting vendors<\/a>. However, it is not yet certain if SPIRAL and DEV-0322 are related in any way.<\/strong><\/p>\n DEV-0322 was seen using CVE-2021-35211<\/a> to launch limited and targeted attacks on organizations in the Asia-Pacific, before venturing towards the US defense industrial base sector and leading companies in the North American healthcare, hospitality, education, software, and telecommunication sectors. The news of the threat campaign comes in the wake of a series of recent attacks<\/a> by the Russian APT group, Nobelium, which was involved in the Solarwinds Orion attack<\/a> in December 2020<\/a>.<\/p>\n The recently discovered vulnerability exists in the implementation of the Serv-U Secure Shell (SSH) protocol. Once the SSH is exposed to the Internet, attackers who successfully exploit it can run arbitrary code with remote privileges, allowing them to install and run malicious codes or view and change data. However, the issue only affects Serv-U 15.2.3 HF1 and older versions.<\/p>\n SolarWinds released a hotfix<\/a> for the zero-day vulnerability immediately after the discovery, and the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning<\/a> on 13 July, 2021 to all SolarWinds users and administrators, emphasizing the urgency to implement the necessary updates.<\/p>\n <\/p>\n <\/p>\n The Chinese group, DEV-0322, exploited two CVEs to gain access to the Serv-U FTP server and conduct its target-specific attacks. Here is our analysis of the vulnerabilities.<\/p>\n <\/p>\n CVE-2021-35211<\/strong><\/p>\n CVE-2021-35211<\/a> is a remote code execution vulnerability in the SolarWinds Serv-U product.<\/p>\n<\/li>\n The CVE is classified under CWE-668 (Exposure of Resource to Wrong Sphere) as a critical vulnerability with a CVSS v3 score of 10.<\/p>\n<\/li>\n The remote memory escape vulnerability allows attackers to gain privileged access to machines hosting Serv-U products.<\/p>\n<\/li>\n A hotfix<\/a>\u00a0for the issue was released by SolarWinds on the day Microsoft discovered the zero-day vulnerability.<\/p>\n<\/li>\n<\/ul>\n <\/p>\n The attackers also actively exploited an existing SolarWinds Orion API vulnerability<\/a> (CVE-2020-10148) to gain initial access to a vulnerable server.\u00a0<\/strong><\/p>\n <\/p>\n CVE-2020-10148<\/strong><\/p>\n CVE-2020-10148<\/a> is an authentication bypass vulnerability in the SolarWinds Orion API. The vulnerability has been in use since it was last exploited in December 2020.<\/p>\n<\/li>\n Classified under two weakness enumerations, CWE-287 (Improper Authentication) and CWE-288 (Authentication Bypass Using an Alternate Path or Channel), the CVE has a CVSS v3 score of 9.8 and is critical in severity.<\/p>\n<\/li>\n The Chinese group exploiting the FTP server was notably using the Orion API issue<\/a> to remotely execute API commands to deploy a Supernova webshell.<\/p>\n<\/li>\n Patches for the CVE were issued after the December 2020 Sunburst malware attack.<\/p>\n<\/li>\n<\/ul>\n <\/p>\n <\/p>\n According to the Microsoft report<\/a>, the DEV-0322 attacks were discovered during a routine test of the Windows Defender antivirus, which detected malicious processes originating from the Serv-U primary application.<\/p>\n The attackers gained initial access to a vulnerable server by leveraging an older Orion API vulnerability (CVE-2020-10148). Once they bypassed authentication through the Secure Shell Protocol (SSH) flaw, they were able to deploy a Supernova webshell<\/a> to the disk using a PowerShell command. This allowed the attackers to aim at all Internet-facing SSH ports and servers in the specific target sectors and create a backdoor.<\/p>\n The Supernova webshell was previously used by a Chinese APT group, Spiral, during the December 2020 SolarWinds attack<\/a>. However, because of the lack of evidence, it is impossible to find a connection between Spiral and DEV-0322.<\/p>\n <\/p>\nServ-U FTP CVE Findings<\/strong><\/h2>\n
\n
\n
![\"Solarwinds](\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/solarwinds-serv-u-vulnerabilities-1.png\")
<\/p>\nDEV-0322 Attack Methodology<\/strong><\/h2>\n
![\"DEV-0322](\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/dev-0322-serv-u-ftp-attack-methodology-version-2.png\")
<\/p>\n
![\"Shodan](\"https:\/\/lh5.googleusercontent.com\/HxI_tqHOeHVFi5TDF4nHJcu1GgQACzGv3TUlh_JfxUKOmFbMQtirNwy-SSatPILkdHerLNJQ1p0OaYpPHz4migD_H-1zNGYYe6OGYHYfzTCRLn1Kdd7uXiG02JpUYfZrQ0KXZpJj\")
<\/p>\n