'Praying Mantis' threat actor targeting Windows internet-facing servers with malware

guest · Jul 27, 2021

'Praying Mantis' threat actor targeting Windows internet-facing servers with malware
...the advanced and persistent threat actor was operating almost completely in-memory
July 27, 2021
https://www.zdnet.com/article/prayi...windows-internet-facing-servers-with-malware/

Windows internet-facing servers are being targeted by a new threat actor operating "almost completely in-memory," according to a new report from the Sygnia Incident Response team.

The report said that the advanced and persistent threat actor -- which they have named "Praying Mantis" or "TG1021" -- mostly used deserialization attacks to load a completely volatile, custom malware platform tailored for the Windows IIS environment.

"TG1021 uses a custom-made malware framework, built around a common core, tailor-made for IIS servers. The toolset is completely volatile, reflectively loaded into an affected machine's memory and leaves little-to-no trace on infected targets," the researchers wrote.
Click to expand...

"Praying Mantis" managed to compromise their networks by exploiting internet-facing servers, and the report notes that the activity observed suggests that the threat actor is highly familiar with the Windows IIS platform and is equipped with 0-day exploits.

The researchers noted that the actors' techniques resemble those mentioned in a June 2020 advisory from the Australian Cyber Security Centre, which warned of "Copy-paste compromises."
The Australian notice said the attacks were being launched by "sophisticated state-sponsored actor" that represented "the most significant, coordinated cyber-targeting against Australian institutions the Australian Government has ever observed."
Click to expand...

The threat actors exploit multiple vulnerabilities to leverage attacks, including a 0-day vulnerability associated with an insecure implementation of the deserialization mechanism within the "Checkbox Survey" web application.
It added that the threat actors have also taken advantage of vulnerabilities with Telerik products, some of which have weak encryption.
Click to expand...

Sygnia: Praying Mantis: An Advanced Memory-Resident Attack

Key Points

The Sygnia Incident Response team identified an advanced and persistent threat actor, operating almost completely in-memory. Sygnia refers to this threat actor as “Praying Mantis” or TG2021.

The operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment.

The threat actor utilized the access provided using the IIS to conduct additional activity, including credential harvesting, reconnaissance, and lateral movement.

The Tactics, Techniques and Procedures (TTPs) used by TG1021, bare various similarities to those of “Copy-Paste Compromises” nation-sponsored actor described by the Australian Cyber Security Centre (ACSC).

Praying Mantis, which has been observed targeting high-profile public and private entities in two major Western markets, exemplifies a growing trend of using nation-state attack methods to target commercial organizations.

‍The full report includes the threat actor’s modus operandi, as well as actionable insights, IOCs and guidelines for defending against Praying Mantis Attacks.

Click to expand...

(PDF):
TG1021: “Praying Mantis” - Dissecting an Advanced Memory-Resident Attack
https://f.hubspotusercontent30.net/hubfs/8776530/TG1021%20-%20Praying%20Mantis%20Threat%20Actor.pdf

guest · Jul 27, 2021

Vulnerability in Popular Survey Tool Exploited in Possible Chinese Attacks on U.S.
July 27, 2021
https://www.securityweek.com/vulnerability-popular-survey-tool-exploited-possible-chinese-attacks-us

Cybersecurity consulting and incident response solutions provider Sygnia on Tuesday published a report detailing attacks launched by a threat actor against “high-profile public and private entities” in the United States.
The Checkbox Survey vulnerability can be exploited remotely without authentication and it impacts version 6 of the application. The flaw does not exist in version 7.0 (released in 2019), but older versions are no longer supported and they will not receive patches.

When it disclosed the vulnerability in May, the CERT Coordination Center (CERT/CC) at Carnegie Mellon University warned that it had been exploited in the wild, but it did not share any information about the attacks.
It’s unclear if the CERT/CC advisory refers to the attacks detailed by Sygnia, but the company told SecurityWeek that it reported its findings to CERT/CC at around the same time the advisory was published. CERT/CC credited an anonymous researcher for reporting the flaw.
Click to expand...

“The nature of the activity and general modus-operandi suggest TG1021 to be an experienced stealthy actor, highly aware of OPSEC,” Sygnia said in its report. “The malware used by TG1021 shows a significant effort to avoid detection, both by actively interfering with logging mechanisms, successfully evading commercial EDRs and by silently awaiting incoming connections, rather than connecting back to a C2 channel and continuously generating traffic. Furthermore, the threat actor actively removed all disk-resident tools after using them, effectively giving up on persistency in exchange for stealth.”
Click to expand...

Log in or Sign up

'Praying Mantis' threat actor targeting Windows internet-facing servers with malware

guest Guest

guest Guest

Log in or Sign up

'Praying Mantis' threat actor targeting Windows internet-facing servers with malware

guest Guest

guest Guest

Useful Searches