HTTP File Server (HFS) (CVE-2024-23692) Attack Cases

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The vulnerability allowed remote command execution on exposed HFS instances; “Using this, the threat actor can send packets containing commands to HFS servers remotely as shown below. This means that the threat actor can exploit the CVE-2024-23692 vulnerability after scanning the externally exposed HFS service to install malware or obtain control.”
• [T1059] Command and Scripting Interpreter – Attackers executed Windows commands to gather info and configure persistence, for example: “cmd /c “whoami”” and “arp -a” and “net user admin12 … /add” and “taskkill /f /im hfs.exe”.
• [T1033] System Owner/User Discovery – The use of “whoami” to determine the current user context.
• [T1016] System Network Configuration Discovery – The use of “arp -a” to enumerate network configuration details.
• [T1136] Create Account – Creation of backdoor accounts to enable RDP access, e.g., “net user admin12 xiao9[removed]02.. /add” and “net localgroup administrators tools /add”.
• [T1070] Indicator Removal on Host – Terminating the HFS process to hinder detection: “taskkill /f /im hfs.exe”.
• [T1021.001] Remote Services – Backdoor accounts used to connect via Remote Desktop (RDP).
• [T1113] Screen Capture – GoThief activity mentions capturing screenshots as part of data collection.
• [T1567.002] Exfiltration to Cloud Storage – GoThief uploads data to AWS S3 (Bucket name: imgdev) and sends it to a C2 server, described as: “the Amazon S3 service (Bucket name: imgdev) to collect the information on files on the desktop, uploaded screenshots, and IP address information to send it to another C&C server.”
• [T1071.001] Web Protocols – Use of C2 channels over HTTP/domains/IPs (e.g., Gh0st RAT and PlugX C2 addresses and domains listed).
• [T1119] Automated Collection (implied by data gathering) – GoThief collects screenshots, file lists, and IP information for exfiltration.