Thousands of enterprise systems are believed to have been infected with a cryptocurrency-mining malware operated by a group tracked under the codename of Blue Mockingbird.
Discovered earlier this month by malware analysts from cloud security firm Red Canary, the Blue Mockingbird group is believed to have been active since December 2019.
Researchers say Blue Mockingbird attacks public-facing servers running ASP.NET apps that use the Telerik framework for their user interface (UI) component.
Hackers exploit the CVE-2019-18935 vulnerability to plant a web shell on the attacked server. They then use a version of the Juicy Potato technique to gain admin-level access and modify server settings to obtain (re)boot persistence.
Once they gain full access to a system, they download and install a version of XMRRig, a popular cryptocurrency mining app for the Monero (XMR) cryptocurrency.
Some attacks pivot to internal networks
Red Canary experts say that if the public-facing IIS servers are connected to a company’s internal network, the group also attempts to spread internally via weakly-secured RDP (Remote Desktop Protocol) or SMB (Server Message Block) connections.
In an email interview earlier this month, Red Canary told ZDNet that they don’t have a full view of this botnet’s operations, but they believe the botnet made at least 1,000 infections so far, just from the limited visibility they had.
“Like any security company, we have limited visibility into the threat landscape and no way of accurately knowing the full scope of this threat,” a Red Canary spokesperson told us.
“This threat, in particular, has affected a very small percentage of the organizations whose endpoints we monitor. However, we observed roughly 1,000 infections within those organizations, and over a short amount of time.”
However, Red Canary says the number of companies impacted could be much higher, and even companies who believe to be safe are at risk of attack.
The dangerous Telerik UI vulnerability
This is because the vulnerable Telerik UI component might be part of ASP.NET applications that are running on their latest versions, yet, the Telerik component might be many versions out of date, still exposing companies to attacks.
Many companies and developers may not even know if the Telerik UI component is even part of their applications, which, again, leaves companies exposed to attacks.
And this confusion has been ruthlessly exploited by attacks over the past year, ever since details about the vulnerability became public.
For example, in an advisory published in late April, the US National Security Agency (NSA) listed the Telerik UI CVE-2019-18935 vulnerability as one of the most exploited vulnerabilities used to plant web shells on servers.
In another security advisory published last week, the Australian Cyber Security Centre (ACSC) also listed the Telerik UI CVE-2019-18935 vulnerability as one of the most exploited vulnerabilities to attack Australian organizations in 2019 and 2020.
In many cases, organizations may not have an option to update their vulnerable apps. In these cases, many companies would need to ensure that they block exploitation attempts for CVE-2019-18935 at their firewall level.
In case they don’t have a web firewall, companies need to look for signs of a compromise at the server and workstation level. Here, Red Canary has released a report with indicators of compromise that companies can use to scan servers and systems for signs of a Blue Mockingbird attack.
“As always, our primary purpose in publishing information like this is to help security teams develop detection strategies for threat techniques that are likely to be used against them. In this way, we think that it’s important for security to evaluate their ability to detect things like COR_PROFILER-based persistence and initial access via Telerik vulnerability exploitation,” Red Canary told ZDNet.