Deep Panda deploys new rootkit “Fire Chili” by exploiting Log4shell in VMware horizon

THREAT LEVEL: Red

For a detailed advisory, download the pdf file here

Deep Panda, a Chinese APT group, took advantage of the well-known Log4Shell vulnerability in VMware Horizon servers to deploy a backdoor, rootkit, and steal sensitive data. This threat actor is primarily targeting firms in the finance, education, beauty, and tourist industries.

The attacks are carried out initially by exploiting Log4Shell (CVE-2021-44228) in the vulnerable VMware Horizon servers. These attacks launched a new PowerShell process that downloaded and executed a series of scripts, culminating in the installation of a Milestone backdoor. Milestone is intended to send information on the current system sessions to the remote server. During the attacks, a kernel rootkit called “Fire Chili” was discovered that was digitally signed with stolen certificates from game development companies, allowing it to avoid detection by security software.

The Mitre TTPs commonly used by Deep Panda are:

TA0042: Resource Development       TA0001: Initial Access       TA0002: Execution       TA0003: Persistence     TA0004: Privilege Escalation       TA0005: Defense Evasion       TA0007: Discovery       TA0009: Collection       TA0010: ExfiltrationTA0043: ReconnaissanceT1190: Exploit Public-Facing ApplicationT1041: Exfiltration Over C2 ChannelT1082: System Information DiscoveryT1036: MasqueradingT1083: File and Directory DiscoveryT1592: Gather Victim Host InformationT1014: RootkitT1620: Reflective Code LoadingT1113: Screen CaptureT1569.002: System Services: Service ExecutionT1059.001: Command and Scripting Interpreter: PowerShellT1027.002: Obfuscated Files or Information: Software PackingT1059.003: Command and Scripting Interpreter: Windows Command ShellT1588.003: Obtain Capabilities: Code Signing CertificatesT1574.002: Hijack Execution Flow: DLL Side-Loading

Actor Details

Vulnerability Details

Indicators of Compromise

Patch Links

https://logging.apache.org/log4j/2.x/manual/migration.html

https://kb.vmware.com/s/article/87073

References

https://www.fortinet.com/blog/threat-research/deep-panda-log4shell-fire-chili-rootkits