Russia-linked state-sponsored threat actor known as Sandworm has been linked to a three-year-long stealthy operation to hack targets by exploiting an IT monitoring tool called Centreon.
The intrusion campaign — which breached "several French entities" — is said to have started in late 2017 and lasted until 2020, with the attacks particularly impacting web-hosting providers, said the French information security agency ANSSI in an advisory.
"On compromised systems, ANSSI discovered the presence of a backdoor in the form of a webshell dropped on several Centreon servers exposed to the internet," the agency said on Monday. "This backdoor was identified as being the PAS webshell, version number 3.1.4. On the same servers, ANSSI found another backdoor identical to one described by ESET and named Exaramel."
The Russian hacker group (also called APT28, TeleBots, Voodoo Bear, or Iron Viking) is said to be behind some of the most devastating cyberattacks in past years, including that of Ukraine's power grid in 2016, the NotPetya ransomware outbreak of 2017, and the Pyeongchang Winter Olympics in 2018.
While the initial attack vector seems unknown as yet, the compromise of victim networks was tied to Centreon, an application, and network monitoring software developed by a French company of the same name.
Centreon, founded in 2005, counts Airbus, Air Caraïbes, ArcelorMittal, BT, Luxottica, Kuehne + Nagel, Ministère de la Justice français, New Zealand Police, PWC Russia, Salomon, Sanofi, and Sephora among its customers. It's not clear how many or which organizations were breached via the software hack.
Compromised servers ran the CENTOS operating system (version 2.5.2), ANSSI said, adding it found on the two different kinds of malware — one publicly available webshell called PAS, and another known as Exaramel, which has been used by Sandworm in previous attacks since 2018.
The web shell comes equipped with features to handle file operations, search the file system, interact with SQL databases, carry out brute-force password attacks against SSH, FTP, POP3, and MySQL, create a reverse shell, and run arbitrary PHP commands.
Exaramel, on the other hand, functions as a remote administration tool capable of shell command execution and copying files to and fro between an attacker-controlled server and the infected system. It also communicates using HTTPS with its command-and-control (C2) server in order to retrieve a list of commands to run.
In addition, ANSSI's investigation revealed the use of common VPN services in order to connect to web shells, with overlaps in C2 infrastructure connecting the operation to Sandworm.
"The intrusion set Sandworm is known to lead consequent intrusion campaigns before focusing on specific targets that fits its strategic interests within the victims pool," the researchers detailed. "The campaign observed by ANSSI fits this behaviour."
In light of the SolarWinds supply-chain attack, it should come as no surprise that monitoring systems such as Centreon have become a lucrative target for bad actors to gain a foothold and laterally move across victim environments. But unlike the former's supply chain compromise, the newly disclosed attacks differ in that they appear to have been carried out by leveraging internet-facing servers running Centreon's software inside the victims' networks.
"It is therefore recommended to update applications as soon as vulnerabilities are public and corrective patches are issued," ANSSI warned. "It is recommended either not to expose these tools' web interfaces to [the] Internet or to restrict such access using non-applicative authentication."
In October 2020, the U.S. government formally charged six Russian military officers for their participation in destructive malware attacks orchestrated by this group, in addition to linking the Sandworm actor to Unit 74455 of the Russian Main Intelligence Directorate (GRU), a military intelligence agency part of the Russian Army.
UPDATE
French software company Centreon on Tuesday issued a clarification following the publication of ANSSI's report, stating none of its customers were affected in the hacking campaign that was found to strike business entities running its network monitoring software.
"The campaign described by ANSSI exclusively concerns obsolete versions of Centreon's open source software," which it said is no longer being actively supported for five years, adding "only about fifteen entities were the target of this campaign.
ANSSI, in its analysis, had said the attacks specifically targeted web-hosting companies.
Besides urging users of its outdated software to update to the latest version, Centreon also made it a point to stress that the campaign is not a supply chain type attack and that "no parallel with other attacks of this type can be made in this case."
