Prophet Spider exploits Log4j and Citrix vulnerabilities to deploy webshells

Threat Level – Amber | Vulnerability Report
Download PDF


For a detailed advisory, download the pdf file here

Prophet Spider is a well-known Initial Access Broker (IAB) group. Prophet Spider’s tradecraft continues to grow while exploiting known web-server vulnerabilities such as Citrix and Log4j.

A remote code execution (RCE) vulnerability(CVE-2021-22941) affecting Citrix ShareFile Storage Zones Controller, was used by Prophet Spider to attack a Microsoft Internet Information Services (IIS) web server. The attacker took advantage of the flaw to launch a WebShell that allowed the download of further tools.

Prophet Spider also exploits known Log4j vulnerabilities in VMware Horizon (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832). Prophet Spider most typically used encoded PowerShell instructions to download a second-stage payload to the targeted PCs after exploiting the vulnerabilities. The specifics of that payload are determined by the attacker’s motivations and aims, such as crypto mining, ransomware, and extortion.

The MITRE TTPs commonly used by Prophet Spider are:

TA0001: Initial Access  

T1190: Exploit Public Facing Application

TA0002: Execution 

T1059.001: Command and Scripting Interpreter: PowerShell

TA0003: Persistence 

T1505.003: Server Software Component: Web Shell

TA0011: Command and Control 

T1071: Application Layer Protocol

T1105: Ingress Tool Transfer

Actor Detail

Vulnerability Details

Indicators of Compromise (IoCs)

Patch Link


What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox