DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach

MITRE Techniques hendryadrian.com

• [T1190] Exploit Public-Facing Application – Attacker exploited a remote code execution vulnerability in Sophos Firewall (CVE-2022-1040) to compromise the device. “…describing a remote code execution (RCE) vulnerability (submitted by a third-party) in its firewalls covered by CVE-2022-1040.”
• [T1505.003] Web Shell – The attacker backdoored the Sophos Firewall with a webshell that could be accessed through any URL of the attacker’s choosing; they loaded a malicious CLASS via ReverseClassLoader. “The attacker created their own version of this file containing malicious logic.”
• [T1539] Steal Web Session Cookie – Using session cookies collected via MITM attacks to compromise external systems outside of the network where the firewall resided; “Using these session cookies, the attacker was able to directly access the WordPress admin panel without sending a username and password.”
• [T1136] Create Account – The attacker created VPN user accounts and associated certificate pairs on the firewall to facilitate legitimate remote network access.
• [T1071.004] Application Layer Protocol: DNS – Modified DNS responses for victim-hosted domains to perform MITM attacks and intercept credentials. “Modified DNS responses were for hostnames that belonged to the victim organization…”
• [T1105] Ingress Tool Transfer – The attacker downloaded and used open-source malware tools from a GitHub repository (Gooogleapis) and referenced related tooling (PupyRAT, Pantegana, Sliver) to facilitate compromise. “Gooogleapis GitHub user and repository containing tools related to compromise of Sophos Firewall devices.”