A vulnerability in the Sophos Firewall, first discovered in late March and patched soon afterwards, was being exploited by a Chinese advanced persistent threat (APT), in the weeks before the patch was released, reports have revealed.
Researchers from cybersecurity firm Volexity, the threat actor, known as DriftingCloud, exploited the CVE-2022-1040 since early March, against a number of unnamed entities. It used it to bypass authentication, and run arbitrary code on the victims’ endpoints. The flaw affects the User Portal and Webadmin of Sophos Firewall, and the threat actors managed to install webshell backdoors and other malware.
At the moment of discovery, the compromise was still active, and the threat actor was still moving around the network, giving the researchers a unique insight into the operation of an APT. The conclusion of that observation is that the group was “sophisticated” and that it made a valiant effort to remain undetected.
Stage two malware
Among other things, the group blended its traffic by accessing the installed webshell through requests to the legitimate file “login.jps”, BleepingComputer reported.
“At first glance, this might appear to be a brute-force login attempt instead of an interaction with a backdoor. The only real elements that appeared out of the ordinary in the log files were the referrer values and the response status codes,” Volexity explained in its writeup.
After accessing the target network, the threat actor moved to install three distinct malware families – PupyRAT, Pantegana, and Sliver. All three are used for remote access, and are publicly available.
The fix for CVE-2022-1040 has been available for months now, and users are advised to patch up immediately, given that its severity score is 9.8.
It’s been a busy quarter for the Sophos team, which recently fixed two high severity vulnerabilities in Sophos Unified Threat Management appliances: CVE-2022-0386 and CVE-2022-0652.
Sophos is a UK-based cybersecurity and network security software developer, focused mostly on security software for organizations with up to 5,000 employees. It was founded in 1985, but pivoted towards cybersecurity in the late 1990s.
In 2019, it was acquired by US-based private equity firm, Thoma Bravo, for approximately $3.9 billion ($7.40 per share).
