Darktrace Threat Research tracked multiple campaigns that exploited CVE-2023-48788 in FortiClient EMS and other internet-facing systems, enabling unauthorized access and post-exploitation activity such as reconnaissance, C2 setup, and lateral movement. The findings highlight the use of Remote Monitoring and Management (RMM) tools for persistence and data exfiltration, with connections to Sliver C2 and Medusa ransomware, underscoring AI-based detection and proactive exposure management as valuable defenses. hashtags #SliverC2 #MedusaRansomware
Keypoints
- Early 2024 campaigns targeted vulnerabilities in internet-facing systems, including FortiClient EMS.
- CVE-2023-48788 is a critical SQL injection flaw (CVSS 9.8) enabling unauthorized access and potential RCE.
- Compromised devices showed anomalous activity, such as installing Remote Monitoring and Management (RMM) tools.
- Post-exploitation included internal reconnaissance, privilege escalation, and lateral movement within networks.
- Threat actors continued exploiting the vulnerability even after public disclosure and patching, with links to Sliver C2 and other frameworks.
- AI security tools like Darktrace can help identify post-exploitation behavior and trigger alerts for abnormal activity.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Exploitation of CVE-2023-48788 to gain initial access to the network. “Exploitation of CVE-2023-48788 to gain initial access to the network.”
- [T1587.003] Develop Capabilities: Digital Certificates – Utilization of digital certificates for malicious purposes. “Utilization of digital certificates for malicious purposes.”
- [T1608.003] Stage Capabilities: Install Digital Certificate – Installation of certificates to facilitate command and control activities. “Installation of certificates to facilitate command and control activities.”
- [T1071.001] Application Layer Protocol: Web Protocols – Use of web protocols for command and control communications. “Use of web protocols for command and control communications.”
- [T1219] Remote Access Software – Installation of RMM tools for maintaining access and control. “Installation of RMM tools for maintaining access and control.”
- [T1059.001] Command and Scripting Interpreter: PowerShell – Execution of PowerShell commands for malicious activities. “Execution of PowerShell commands for malicious activities.”
- [T1595] Active Scanning – Use of tools like Nmap for network scanning and reconnaissance. “Use of tools like Nmap for network scanning and reconnaissance.”
- [T1590.005] Gather Victim Network Information: IP Addresses – Gathering information about the victim’s network structure. “Gathering information about the victim’s network structure.”
- [T1046] Network Service Discovery – Discovery of network services for lateral movement. “Discovery of network services for lateral movement.”
- [T1110] Brute Force – Brute force attempts to gain access to accounts. “Brute force attempts to gain access to accounts.”
- [T1078] Valid Accounts – Use of valid accounts for maintaining access. “Use of valid accounts for maintaining access.”
- [T1021.002] Remote Services: SMB/Windows Admin Shares – Use of SMB for lateral movement between devices. “Use of SMB for lateral movement between devices.”
- [T1021.003] Remote Services: Distributed Component Object Model – Exploitation of DCE-RPC for lateral movement. “Exploitation of DCE-RPC for lateral movement.”
- [T1569.002] System Services: Service Execution – Execution of services for malicious purposes. “Execution of services for malicious purposes.”
- [T1047] Windows Management Instrumentation – Use of WMI for executing commands remotely. “Use of WMI for executing commands remotely.”
- [T1041] Exfiltration Over C2 Channel – Data exfiltration through command and control channels. “Data exfiltration through command and control channels.”
- [T1567.002] Exfiltration Over Web Service: Exfiltration to Cloud Storage – Uploading sensitive data to cloud storage services. “Uploading sensitive data to cloud storage services.”
Indicators of Compromise
- [URL] 212.32.243[.]25/SETUP.MSI, 89.149.200[.]9/SETUP.MSI – Payload URLs
- [URL] 212.113.106[.]100/setup.msi – Payload URL
- [URL] 95.181.173[.]172/run.zip – Payload URL
- [Domain] serv1[.]api[.]9hits[.]com – Likely C2 endpoint
- [IP] 128.199.207[.]131 – Likely C2 endpoint
- [Domain] azure-documents[.]com – C2 endpoint
- [IP] 104.168.140[.]84 – C2 endpoint
- [IP] 77.246.103[.]110 – Likely C2 endpoint
- [IP] 212.113.106[.]100 – C2 endpoint