Article Details
Scrape Timestamp (UTC): 2024-08-20 10:29:08.903
Source: https://thehackernews.com/2024/08/hackers-exploit-php-vulnerability-to.html
Original Article Text
Click to Toggle View
Hackers Exploit PHP Vulnerability to Deploy Stealthy Msupedge Backdoor. A previously undocumented backdoor named Msupedge has been put to use against a cyber attack targeting an unnamed university in Taiwan. "The most notable feature of this backdoor is that it communicates with a command-and-control (C&C) server via DNS traffic," the Symantec Threat Hunter Team, part of Broadcom, said in a report shared with The Hacker News. The origins of the backdoor are presently unknown as are the objectives behind the attack. The initial access vector that likely facilitated the deployment of Msupedge is said to involve the exploitation of a recently disclosed critical flaw impacting PHP (CVE-2024-4577, CVSS score: 9.8), which could be used to achieve remote code execution. The backdoor in question is a dynamic-link library (DLL) that's installed in the paths "csidl_drive_fixed\xampp\" and "csidl_system\wbem\." One of the DLLs, wuplog.dll, is launched by the Apache HTTP server (httpd). The parent process for the second DLL is unclear. The most notable aspect of Msupedge is its reliance on DNS tunneling for communication with the C&C server, with code based on the open-source dnscat2 tool. "It receives commands by performing name resolution," Symantec noted. "Msupedge not only receives commands via DNS traffic but also uses the resolved IP address of the C&C server (ctl.msedeapi[.]net) as a command." Specifically, the third octet of the resolved IP address functions as a switch case that determines the behavior of the backdoor by subtracting seven from it and using its hexadecimal notation to trigger appropriate responses. For example, if the third octet is 145, the newly derived value translates to 138 (0x8a). The commands supported by Msupedge are listed below - The development comes as the UTG-Q-010 threat group has been linked to a new phishing campaign that leverages cryptocurrency- and job-related lures to distribute an open-source malware called Pupy RAT. "The attack chain involves the use of malicious .lnk files with an embedded DLL loader, ending up in Pupy RAT payload deployment," Symantec said. "Pupy is a Python-based Remote Access Trojan (RAT) with functionality for reflective DLL loading and in-memory execution, among others."
Daily Brief Summary
A previously undocumented backdoor named Msupedge was used in a cyber attack on an unnamed university in Taiwan.
The attack exploited a critical vulnerability in PHP (CVE-2024-4577) to deploy the Msupedge backdoor, enabling remote code execution.
Msupedge communicates with its command-and-control (C&C) server using DNS traffic, specifically employing DNS tunneling techniques.
The backdoor operates as a DLL installed in specific system paths and is triggered by the Apache HTTP server.
Commands to the backdoor are encoded in the resolved IP address from the C&C server, dictating the backdoor's operational behavior.
Symantec’s report points out the obscure objectives and origins of the attackers using Msupedge, suggesting a complex threat environment.
The backdoor's communication method and stealth features indicate a high level of sophistication in its design and execution.
The same threat report highlighted the emerging threat from UTG-Q-010, which distributes the Pupy RAT using phishing tactics related to jobs and cryptocurrency.