Log4j vulnerabilities are now being used to deploy Cobalt Strike beacons through the Windows Defender command line tool, researchers have found.
Cybersecurity researchers from Sentinel Labs recently spotted a new method, employed by an unknown threat actor, with the endgame being the deployment of LockBit 3.0 ransomware.
It works like this: the threat actor would leverage log4shell (as the Log4j zero-day is dubbed) to gain access to a target endpoint, and obtain the necessary user privileges. Once that’s out of the way, they’d use PowerShell to download three separate files: a Windows CL utility file (clean), a DLL file (mpclient.dll), and a LOG file (the actual Cobalt Strike beacon).
Side-loading Cobalt Strike
They would then run MpCmdRun.exe, a command line utility that performs various tasks for Microsoft Defender. That program would usually load a legitimate DLL file – mpclient.dll, which it needs to correctly run. But in this instance, the program would load a malicious DLL of the same name, downloaded together with the program.
That DLL will have the LOG file load and decrypt an encrypted Cobalt Strike payload.
It’s a method known as side-loading.
Usually, this LockBit affiliate used VMware’s command line tools to side-load Cobalt Strike beacons, BleepingComputer says, so the switch to Windows Defender is somewhat unusual. The publication speculates the change was made to bypass targeted protections that VMware recently introduced. Still, using living-off-the-land tools to evade being detected by antivirus (opens in new tab) or malware (opens in new tab) protection services is “extremely common” these days, the publication concludes, urging businesses to check their security controls and be vigilant with tracking how legitimate executables are being (ab)used.
Even though Cobalt Strike is a legitimate tool, used for penetration testing, it’s grown quite infamous as it’s being abused by threat actors everywhere. It comes with an extensive list of features that cybercriminals can use to map out the target network, undetected, and move laterally across endpoints, as they prepare to steal data and deploy ransomware.
Via: BleepingComputer (opens in new tab)
