Prophet Spider exploits Log4j and Citrix vulnerabilities to deploy webshells

Threat Level – Amber | Vulnerability Report

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here

Prophet Spider is a well-known Initial Access Broker (IAB) group. Prophet Spider’s tradecraft continues to grow while exploiting known web-server vulnerabilities such as Citrix and Log4j.

A remote code execution (RCE) vulnerability(CVE-2021-22941) affecting Citrix ShareFile Storage Zones Controller, was used by Prophet Spider to attack a Microsoft Internet Information Services (IIS) web server. The attacker took advantage of the flaw to launch a WebShell that allowed the download of further tools.

Prophet Spider also exploits known Log4j vulnerabilities in VMware Horizon (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832). Prophet Spider most typically used encoded PowerShell instructions to download a second-stage payload to the targeted PCs after exploiting the vulnerabilities. The specifics of that payload are determined by the attacker’s motivations and aims, such as crypto mining, ransomware, and extortion.

The MITRE TTPs commonly used by Prophet Spider are:

TA0001: Initial Access

T1190: Exploit Public Facing Application

TA0002: Execution

T1059.001: Command and Scripting Interpreter: PowerShell

TA0003: Persistence

T1505.003: Server Software Component: Web Shell

TA0011: Command and Control

T1071: Application Layer Protocol

T1105: Ingress Tool Transfer