Prophet Spider exploits Log4j and Citrix vulnerabilities to deploy webshells

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Prophet Spider is a well-known Initial Access Broker (IAB) group. Prophet Spider's tradecraft continues to grow while exploiting known web-server vulnerabilities such as Citrix and Log4j. A remote code execution (RCE) vulnerability(CVE-2021-22941) affecting Citrix ShareFile Storage Zones Controller, was used by Prophet Spider to attack a Microsoft Internet Information Services (IIS) web server. The attacker took advantage of the flaw to launch a WebShell that allowed the download of further tools. Prophet Spider also exploits known Log4j vulnerabilities in VMware Horizon (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832). Prophet Spider most typically used encoded PowerShell instructions to download a second-stage payload to the targeted PCs after exploiting the vulnerabilities. The specifics of that payload are determined by the attacker's motivations and aims, such as crypto mining, ransomware, and extortion. The MITRE TTPs commonly used by Prophet Spider are: TA0001: Initial Access T1190: Exploit Public Facing Application TA0002: Execution T1059.001: Command and Scripting Interpreter: PowerShell TA0003: Persistence T1505.003: Server Software Component: Web Shell TA0011: Command and Control T1071: Application Layer Protocol T1105: Ingress Tool Transfer Actor Detail Vulnerability Details Indicators of Compromise (IoCs) Patch Link https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.15.0/ https://logging.apache.org/log4j/2.x/manual/migration.html https://github.com/apache/logging-log4j2/pull/607/files https://www.citrix.com/downloads/sharefile/product-software/sharefile-storagezones-controller-511.html References https://blogs.blackberry.com/en/2022/01/log4u-shell4me https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/