US federal agency hacked using old Telerik bug to steal data

Last year, a U.S. federal agency's Microsoft Internet Information Services (IIS) web server was hacked by exploiting a critical .NET deserialization vulnerability in the Progress Telerik UI for ASP.NET AJAX component. According to a joint advisory issued today by CISA, the FBI, and MS-ISAC, the attackers had access to the server between November 2022 and early January 2023 based on indicators of compromise (IOCs) found on the unnamed federal civilian executive branch (FCEB) agency's network. At least two threat actors (one of them the Vietnamese XE Group) accessed the unpatched server by exploiting this bug (CVE-2019-18935) to gain remote code execution. After hacking into the unnamed federal civilian executive branch (FCEB) agency's server, they deployed malicious payloads in the C:\Windows\Temp\ folder to collect and exfiltrate information to attacker-controlled command and control servers. The malware installed on the compromised IIS server could deploy additional payloads, evading detection by deleting its traces on the system, and opening reverse shells to maintain persistence. It could also be used to drop an ASPX web shell that provides an interface for browsing the local system, downloading and uploading files, and executing remote commands. However, as detailed in the advisory, "no webshells were observed to be dropped on the target system, likely due to the abused service account having restrictive write permissions." More information on the malware installed on th...