Hackers Exploiting Progress WhatsUp RCE Vulnerability In The Wild

RCE attacks on WhatsUp Gold exploited the Active Monitor PowerShell Script to execute malicious code, as the vulnerabilities CVE-2024-6670 and CVE-2024-6671, patched on August 16, were leveraged to execute remote access tools and gain persistence.

Despite the availability of patches, many organizations were slow to apply them, leading to widespread attacks.

The attackers abused NmPoller.exe to execute PowerShell scripts and download malicious payloads.

To mitigate these attacks, organizations should implement strict access controls, apply patches promptly, and monitor for suspicious process creation events.

An attacker exploited a vulnerability in WhatsUp Gold’s Active Monitor PowerShell Script functionality to execute malicious code, where the attack bypassed user login and downloaded a script from a suspicious URL.

The script then downloaded additional malware (potentially a remote access tool) and executed it. The entire attack leveraged legitimate processes (NmPoller.exe and PowerShell) to avoid detection.

The threat actor attempted to install remote administration tools (RATs) on the target system using PowerShell and employed msiexec.exe to install Atera Agent, Radmin, SimpleHelp Remote Access, and Splashtop Remote.

Atera Agent and Splashtop Remote were installed from a single MSI installer retrieved from a malicious URL, which was mitigated by the MXDR team, preventing further damage.

While the threat actor remains unidentified, the use of multiple RATs hints at potential ransomware involvement.

The recent disclosure of critical vulnerabilities in WhatsUp Gold, CVE-2024-4885 and CVE-2024-4886, has led to a rapid increase in exploitation attempts.

A PoC for CVE-2024-4886 was released on August 30, 2024, and within hours, Trend Micro observed the first successful exploitation, suggesting that threat actors were actively monitoring the vulnerability landscape and quickly leveraged the publicly available PoC.

The presence of 1,207 exposed devices online for CVE-2024-4885, a vulnerability with a CVSS score of 9.8, further highlights the urgency of applying security patches promptly to mitigate the risk of exploitation.

The WhatsUp Gold compromise exploited a user authentication vulnerability to execute malicious code.

To prevent similar attacks, apply the latest patch, restrict access to the management console, use strong passwords, and monitor for suspicious process creation events by nmpoller.exe.

Focus on processes that execute PowerShell scripts and MSI packages. Consider suspending the Active Monitor PowerShell Script function until the patch is applied.

Tighten access controls and closely monitor all related processes.

Patch management remains crucial despite challenges. Prompt patch applications, even without PoCs, are essential for severe vulnerabilities.

Beyond patching, access control, MFA, strong passwords, and passkeys are crucial defenses.