Holiday Attack Spikes Target Ancient Vulnerabilities and Hidden Webshells

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The vulnerability would-be attackers are attempting to exploit is an arbitrary file upload vulnerability found in Downloads Manager <= 0.2. A lack of adequate validation made it possible for files to be uploaded and run on a vulnerable website. ‘The vulnerability would-be attackers are attempting to exploit is an arbitrary file upload vulnerability found in Downloads Manager <= 0.2. A lack of adequate validation made it possible for files to be uploaded and run on a vulnerable website.’
• [T1505.003] Web Shell – Attackers used web shells such as Mister Spy Bot V7 and Saber BOT V1 to upload payloads, obtain reverse shells, and perform actions like defacement and user registration. ‘The Mister Spy shell returns some basic information about the operating system the website is running on, and the location of the site root on that system, and allows for files to be uploaded. In addition to these features, Mister Spy payloads typically include a reverse shell that allows a successful attacker to obtain additional information about the content management system being used on the website, install additional shells, deface the website, register malicious users on the website, and collect configuration details, among other features.’
• [T1082] System Information Discovery – The Mister Spy Bot V7 payload reveals OS information and site root location, aiding reconnaissance. ‘The Mister Spy shell returns some basic information about the operating system the website is running on, and the location of the site root on that system…’