A Korean-targeted intrusion campaign leveraged FRP-based reverse proxy techniques to gain unauthorized external access to internal networks, often starting with vulnerable IIS or MS Exchange servers. The operation included Webshells (ASPXSpy), privilege escalation via Potato tools, and later deployment of FRP/LCX for remote access, with some cases progressing to ransomware using BitLocker. #ASPXSpy #FRP #Potato #JuicyPotato #BadPotato #SweetPotato #HTran #LCX #RDP #BitLocker #IIS #MSExchange
Keypoints
- Attackers infiltrate externally exposed IIS web servers or MS Exchange servers, targeting Korean companies with a groupumed to be behind the activity.
- ASPXSpy, a major ASPX web shell, is used to control compromised servers and perform actions like information lookup, file creation, and process execution.
- Privilege escalation is performed using Potato tools (JuicyPotato, BadPotato, SweetPotato) to move from web service accounts to system-level privileges.
- Exploitation for Privilege Escalation via PoCs (CVE-2021-1732 and CVE-2022-21999) is employed to escalate privileges and enable persistence.
- FRP (Fast Reverse Proxy) and LCX (HTran) are used to establish external access, often via relay servers located on compromised Korean company systems.
- Some campaigns employ RDP-based forwardings and port forwarding techniques to mask attacker IPs and maintain control over affected hosts.
- Ransomware activity is limited and often leverages BitLocker to encrypt drives, with ransom notes shown to victims; in many cases the attack chain ends with data/drive encryption.
MITRE Techniques
- [T1100] Web Shell – ASPXSpy is the major ASPX Webshell used on vulnerable IIS servers to enable control and command execution. “ASPXSpy is the major ASPX Webshell and it has been verified that the hacker has used this web shell for multiple attacks.”
- [T1059] Command and Scripting Interpreter – Webshells enable command execution and file operations within the target server. “Hackers can perform various malicious acts in this panel including looking up information, creating files, and executing processes.”
- [T1134] Access Token Manipulation – Privilege escalation via token abuse to reach system privileges (Potato family). “Potato is an open-source privilege escalation tool published on GitHub. It operates by abusing specific privileges from the tokens of the process account currently being run and provides the feature of escalating said privileges into system privileges.”
- [T1068] Exploitation for Privilege Escalation – CVE-based PoCs used to escalate privileges. “The following is a PoC that abuses CVE-2021-1732 vulnerabilities to escalate privileges… The following is a CVE-2022-21999 PoC that can load the designated DLL and run malware after privilege escalation.”
- [T1090] Proxy – FRP (Fast Reverse Proxy) creates a proxy between attacker and target to enable external access. “FRP is an open source tool formed with a mediating dummy to enable external access to an intranet PC that cannot be accessed directly.”
- [T1021.001] Remote Services – RDP-based access via FRP/relay chains; attackers use remote desktop connections to manage compromised hosts. “FRP tools were commonly used by hackers in ‘remote desktop connections’ and ‘masking attacker IP’.”
- [T1486] Data Encrypted for Impact – BitLocker-based ransomware activity to encrypt drives. “The hackers encrypted using the following command… manage-bde to enable the use of the BitLocker feature…”
Indicators of Compromise
- [MD5] – ASP WebShell related hashes – e31b7d841b1865e11eab056e70416f1a, 612585fa3ada349a02bc97d4c60de784, 3921d444a251661662f991b147e22bc3, and other MD5 hashes
- [MD5] – Potato tools hashes (JuicyPotato) – 0311ee1452a19b97e626d24751375652, 808502752ca0492aca995e9b620d507b, 4bafbdca775375283a90f47952e182d9
- [MD5] – Potato tool hashes (BadPotato) – 9fe61c9538f2df492dff1aab0f90579f, ab9091f25a5ad44bef898588764f1990, 87e5c9f3127f29465ae04b9160756c62
- [MD5] – Potato tool hashes (SweetPotato) – fd0f73dd80d15626602c08b90529d9fd, 937435bbcbc3670430bb762c56c7b329
- [URL] – Frpc download URLs used by attacker – hxxp://www.ive***.co[.]kr/uploadfile/ufaceimage/1/info.zip, hxxp://www.ive***.co[.]kr/uploadfile/ufaceimage/1/update.zip
- [File Name] – Frpc related files – update.exe, info.zip, f.zip, frpc.exe, perflogsupdate.exe, tempupdate.exe, tempinfo.zip
- [File Name] – Frps/relay related components – Frps.exe
Read more: https://asec.ahnlab.com/en/38156/