Threat Signal ReportCadet Blizzard - Destructive Attacks Targeting Multiple Organizations and Entities Around the Globe
Description
FortiGuard Labs is aware of recent reports of a new APT group called Cadet Blizzard. Most recent notable attacks attributed to this group were the 2022 WhisperGate MBR wiping attacks along with the various destructive/defacement of websites of various organizations within Ukraine.
have also been observed in Central Asia, Europe and Latin America. Cadet Blizzard uses known living off the land techniques to perform lateral movement to essentially cause damage, destruction and downtime to victims targeted.
What is the Modus Operandi?
Cadet Blizzard has been observed performing data exfiltration/wiping, defacement, destruction and espionage against victims. The leaking of sensitive data has been observed as well to create further chaos and pain points for victims already crippled by the threat actor.
Cadet Blizzard leverages an arsenal of tools used to conduct operations, including known living off the land techniques. Observed tactics were the usage of various vulnerabilities, specifically:
CVE-2021-26084 - which is a Confluence OGNL web injection vulnerability that allows for arbitrary code execution (ACE).
CVE-2022-41040 - ProxyNotShell was (at the time) a zero day vulnerability in Microsoft Exchange that allowed for remote command execution (RCE).
CVE-2021-34473 - ProxyShell, similar to ProxyNotShell was a vulnerability in Microsoft Exchange that allow for remote command execution (RCE). Both ProxyShell and ProxyNotShell vulnerabilities are similar, whereas ProxyNotShell requires authentication.
Other TTPs observed were the usage of known commodity and custom web shells, credential harvesting, evasion, privilege escalation, registry dumping and lateral movement attacks. Finally, exfiltrated data containing sensitive documentation was leaked to various Darkweb (TOR) and Telegram sites compounding further damage to the victim.
Is DEV-0586 the Same Threat Actor as Cadet Blizzard?
Yes.
What Regions were Targeted?
According to the report - besides Ukraine, parts of Central Asia, Europe and Latin America have been targeted.
What Sectors were Targeted?
Government, non-government (NGOs) and information technology sectors.
What is the Status of Coverage?
FortiGuard Customers running the latest definitions are protected by the following (AV) signatures:
JS/ReGeorg.B!tr
PHP/WebShell.NIB!tr
JS/WebShell.0DD2!tr
PHP/WebShell.NAF!tr
PHP/Kryptik.AJ!tr
FortiGuard customers running the latest definitions are protected by the following (IPS) signatures:
For CVE-2021-26084:
Atlassian.Confluence.CVE-2021-26084.Remote.Code.Execution
For both ProxyShell CVE-2021-34473 and ProxyNotShell CVE-2022-41040:
MS.Exchange.Server.Autodiscover.Remote.Code.Execution
For further detailed protections on ProxyNotShell, please refer to our Outbreak Alert page:
