Lazarus Uses ManageEngine Flaw to Deploy QuiteRAT in European Infrastructure Breach
Summary
Cisco Talos reports that Lazarus exploited ManageEngine ServiceDesk CVE-2022-47966 to compromise a European internet backbone provider and deploy QuiteRAT, a compact Qt-based remote access trojan related to MagicRAT.
Key points
- Talos observed Lazarus exploiting ManageEngine ServiceDesk CVE-2022-47966 five days after public proof-of-concept exploits appeared.
- The campaign compromised a European internet backbone provider and also targeted healthcare entities in Europe and the United States.
- QuiteRAT gathers system information and lets its operators run commands through a command-and-control server.
- The malware uses Qt libraries and is smaller than MagicRAT; Talos assesses it is a derivative of that implant.
- QuiteRAT lacks built-in persistence; operators can direct it to create a Windows service for continued operation.
- Talos published a malware hash and network indicators of compromise.
Article Details
- Attack Vectors
- Exploited CVE-2022-47966 in ManageEngine ServiceDesk to gain initial access and deploy QuiteRAT.
- Used cURL to download a malicious binary from an attacker-used URL; the Java runtime process then executed it.
- QuiteRAT communicates with command-and-control servers over HTTP GET, receives commands and payloads, and can execute Windows commands through a child cmd.exe process.
- Persistence was established by issuing a command to create an automatically starting Windows service.
- Defensive Notes
- Cisco Talos says Qt-based malware can be harder for human analysts to inspect and may be less reliably detected by machine-learning and heuristic methods.
- The article recommends using Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, Cisco Duo, and current Snort Subscriber Rule Set rules to help prevent, detect, or block related activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 146[.]4[.]21[.]94 | IP address reported as used by Lazarus Group since at least May 2022 and associated with QuiteRAT delivery. |
| SHA256 | ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 | Hash identified as a QuiteRAT malware binary. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryQuiteRAT ran ipconfig and filtered for Suffix to obtain network/domain information.T1027 · Obfuscated Files or InformationQuiteRAT's configuration strings were XOR-encoded and base64-encoded.T1059.003 · Windows Command ShellQuiteRAT executes Windows commands through cmd.exe, including commands used for reconnaissance and persistence.T1071.001 · Web ProtocolsQuiteRAT used HTTP GET requests to communicate with its C2 server and exchange commands and data.T1082 · System Information DiscoveryQuiteRAT ran systeminfo and filtered for Logon to obtain system information.T1105 · Ingress Tool TransferThe attackers used cURL to download the QuiteRAT binary from a malicious URL.T1190 · Exploit Public-Facing ApplicationLazarus Group exploited the ManageEngine ServiceDesk vulnerability CVE-2022-47966 to gain initial access.T1497.003 · Time Based ChecksQuiteRAT can delay further C2 communications for a specified period after receiving a sleep command.T1543.003 · Windows ServiceQuiteRAT persistence was established with a command that created an automatically starting Windows service.
CVE
People
Threat Actors
Malware
Vendors
CiscoCisco Talos discovered the North Korean state-sponsored actor Lazarus Group targeting internet backbone infrastructure and healthcare entities in Europe and the United States.ManageEngineLazarus Group exploits ManageEngine vulnerability to deploy QuiteRATWithSecurethis implant belongs to the previously disclosed MagicRAT family. QuiteRAT was briefly discussed in WithSecure’s report from early 2023. The new campaign we’re disclosing exploited a ManageEngine ServiceDesk
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.MagicRATQuiteRAT has many of the same capabilities as Lazarus Group’s better-known MagicRAT malware, but its file size is significantly smaller.ManageEngine ServiceDeskIn this campaign, the attackers began exploiting a ManageEngine ServiceDesk vulnerability (CVE-2022-47966) five days after PoCs for the exploit were publicly disclosed to deliver and deploy a newer malware threat weQtBoth implants are built on the Qt framework and include capabilities such as arbitrary command execution.QuiteRATLazarus Group exploits ManageEngine vulnerability to deploy QuiteRATSnort Subscriber Rule SetOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Tools
Countries
EuropeCisco Talos discovered the North Korean state-sponsored actor Lazarus Group targeting internet backbone infrastructure and healthcare entities in Europe and the United States.North KoreaUnited StatesCisco Talos discovered the North Korean state-sponsored actor Lazarus Group targeting internet backbone infrastructure and healthcare entities in Europe and the United States.
Industries
HealthcareCisco Talos discovered the North Korean state-sponsored actor Lazarus Group targeting internet backbone infrastructure and healthcare entities in Europe and the United States.Internet backbone infrastructureCisco Talos discovered the North Korean state-sponsored actor Lazarus Group targeting internet backbone infrastructure and healthcare entities in Europe and the United States.