Digium Phones Under Attack: Insight Into the Web Shell Implant

MITRE Techniques

• [T1505.003] Web Shell – The attacker installs a PHP web shell backdoor and uses it to run commands and maintain access. ‘The PHP web shell contains random junk comments, in an attempt to evade signature-based defenses. Additionally, it is wrapped in multiple layers of Base64 encoding, in order to mask its true intent.’
• [T1190] Exploit Public-Facing Application – CVE-2021-45461 enables remote code execution via the Rest Phone Apps module. ‘This vulnerability lies in the Rest Phone Apps (restapps) module, allowing for a URL variable to potentially get passed, resulting in a remote code execution (RCE) scenario.’
• [T1053.005] Scheduled Task – Persistence by scheduling a task that runs every minute to fetch and execute a remote script. ‘Adds a scheduled task entry.
  Runs every minute.’
• [T1136] Create Account – Persistence via creation of new root user accounts (sugarmaint and supports). ‘Creation of root user accounts.’
• [T1027] Obfuscated/Compressed Files and Information – Use of Base64 encoding layers to hide payloads. ‘There are always 14 lines of code, wrapped in multiple layers of Base64 encoding to hide certain key areas.’
• [T1105] Ingress Tool Transfer – Downloading and executing additional payloads from remote infrastructure. ‘The dropper variant fetches and executes a remote script from the attacker’s infrastructure: IPv4 address 37.49.230.74.’