Facefish

FaceFish is a backdoor observed in intrusions attributed by Kaspersky to the hacktivist group Twelve, which has targeted Russian organizations in the context of the Russian-Ukrainian conflict. In the reported incident, the malware was deployed on a VMware vCenter server after attackers exploited VMware vSphere vulnerabilities CVE-2021-21972 and CVE-2021-22005 to install a web shell, which was then used to drop the backdoor. FaceFish saved a libs.so library, injected it into the sshd process via ld.so.preload, and restarted the SSH service, indicating Linux/VMware appliance targeting and SSH-based persistence. The surrounding intrusion activity included use of valid accounts, RDP, PowerShell, ngrok, Cobalt Strike, Mimikatz, PHP web shells, credential theft, data exfiltration, ransomware, and Shamoon-like wipers. High-confidence indicators directly mentioned in the content include the malware name FaceFish, deployment via a web shell on VMware vCenter, exploitation of CVE-2021-21972 and CVE-2021-22005, creation of libs.so, use of ld.so.preload for injection into sshd, and SSH service restart. The content also notes the name Facefish as a prior iteration associated with PUMAKIT, alongside later iterations Kitsune and Megatsune.