WIREFIRE

According to Ivanti and a blog by Volexity, these two vulnerabilities were exploited in the wild in a chained attack for unauthenticated remote code execution (RCE) as early as December 3, 2023. | CVE-2024-21887 is a command injection vulnerability in the web component of Ivanti ICS and Policy Secure that can be abused to execute arbitrary commands by an authenticated user. | CVE-2023-46805 is an authentication bypass vulnerability in the web component of Ivanti Connect Secure (ICS), previously known as Pulse Connect Secure and Ivanti Policy Secure. This vulnerability allows an attacker to bypass control checks and access restricted resources.

They function as dormant backdoors, activated only when attackers submit specific HTTP requests containing commands or credentials.

the adversary executed suspicious Python scripts and /bin/sh commands from the /tmp directory

the adversary executed suspicious Python scripts... from the /tmp directory

“Cyber actors will exploit software vulnerabilities such as command-injection and achieve unauthenticated remote code execution (RCE).”

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

The adversary accessed VMs and deployed malicious payloads, including the BRICKSTORM backdoor and a web shell MITRE called BEEFLUSH.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

a base64 encoded logo.gif file was an exact copy of a log file on the system which the adversary exfiltrated

BEEFLUSH ... communicated with several internal IP addresses making POST requests.

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

The adversary uploaded a Python script, visits.py, that contained the WIREFIRE (aka GIFTEDVISITOR) web shell

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

The adversary exfiltrated data from the NERVE using command-and-control infrastructure.