Cyber Security News

Hackers Exploiting Progress WhatsUp RCE Vulnerability In The Wild

RCE attacks on WhatsUp Gold exploited the Active Monitor PowerShell Script to execute malicious code, as the vulnerabilities CVE-2024-6670 and CVE-2024-6671, patched on August 16, were leveraged to execute remote access tools and gain persistence.

Despite the availability of patches, many organizations were slow to apply them, leading to widespread attacks.

The attackers abused NmPoller.exe to execute PowerShell scripts and download malicious payloads.

To mitigate these attacks, organizations should implement strict access controls, apply patches promptly, and monitor for suspicious process creation events.

Timeline how the WhatsUp Gold Active Monitor PowerShell Script was abused

An attacker exploited a vulnerability in WhatsUp Gold’s Active Monitor PowerShell Script functionality to execute malicious code, where the attack bypassed user login and downloaded a script from a suspicious URL.

The script then downloaded additional malware (potentially a remote access tool) and executed it. The entire attack leveraged legitimate processes (NmPoller.exe and PowerShell) to avoid detection.

The PowerShell script executed as Active Monitor PowerShell Script by NmPoller.exe

The threat actor attempted to install remote administration tools (RATs) on the target system using PowerShell and employed msiexec.exe to install Atera Agent, Radmin, SimpleHelp Remote Access, and Splashtop Remote.

Atera Agent and Splashtop Remote were installed from a single MSI installer retrieved from a malicious URL, which was mitigated by the MXDR team, preventing further damage.

While the threat actor remains unidentified, the use of multiple RATs hints at potential ransomware involvement.

The recent disclosure of critical vulnerabilities in WhatsUp Gold, CVE-2024-4885 and CVE-2024-4886, has led to a rapid increase in exploitation attempts.

Execution profile for msiexec.exe installing Atera Agent and Splashtop Remote

A PoC for CVE-2024-4886 was released on August 30, 2024, and within hours, Trend Micro observed the first successful exploitation, suggesting that threat actors were actively monitoring the vulnerability landscape and quickly leveraged the publicly available PoC.

The presence of 1,207 exposed devices online for CVE-2024-4885, a vulnerability with a CVSS score of 9.8, further highlights the urgency of applying security patches promptly to mitigate the risk of exploitation.

The WhatsUp Gold compromise exploited a user authentication vulnerability to execute malicious code.

To prevent similar attacks, apply the latest patch, restrict access to the management console, use strong passwords, and monitor for suspicious process creation events by nmpoller.exe.

Focus on processes that execute PowerShell scripts and MSI packages. Consider suspending the Active Monitor PowerShell Script function until the patch is applied.

Tighten access controls and closely monitor all related processes.

Patch management remains crucial despite challenges. Prompt patch applications, even without PoCs, are essential for severe vulnerabilities.

Beyond patching, access control, MFA, strong passwords, and passkeys are crucial defenses.

Aman Mishra

Recent Posts

Node.js systeminformation Package Vulnerability Exposes Millions of Systems to RCE Attacks

A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…

1 day ago

Skuld Malware Using Weaponized Windows Utilities Packages To Deliver Malware

Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…

2 days ago

BellaCiao, A new .NET Malware With Advanced Sophisticated Techniques

An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial…

2 days ago

Malicious Apps On Amazon Appstore Records Screen And Interecpt OTP Verifications

A seemingly benign health app, "BMI CalculationVsn," was found on the Amazon App Store, which…

2 days ago

Lazarus Hackers Using New VNC Based Malware To Attack Organizations Worldwide

The Lazarus Group has recently employed a sophisticated attack, dubbed "Operation DreamJob," to target employees…

2 days ago

New Python NodeStealer Attacking Facebook Business To Steal Login Credentials

NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets…

2 days ago