Threat Signal Report

International Joint Advisory for Accellion File Transfer Appliance Exploitation leveraged by FIN11, UNC2546, and UNC258

Description

Today, a multinational joint advisory was issued by multiple cybersecurity authorities: Australian Cyber Security Centre (ACSC), New Zealand National Cyber Security Centre (NZ NCSC), Cyber Security Agency of Singapore (CSA), United Kingdom National Cyber Security Centre (NCSC), United States Cybersecurity and Infrastructure Security Agency (CISA), and United States Multi State Information Sharing and Analysis Center (MS-ISAC).

This latest advisory, "Exploitation of Accellion File Transfer Appliance AA21-055A," provides in-depth analysis of a campaign leveraging known vulnerabilities in the Accellion File Transfer Appliance (FTA) and impacting many organizations worldwide. According to the multiple sources, the modus operandi of this group is to perform data exfiltration for the purposes of extortion. Attacks have been attributed to threat actors FIN11, UNC258, and UNC2456 .

What are the Technical Details of the Threat?

Four vulnerabilities were leveraged by the threat actors known as FIN11, UNC258, and UNC2456.

They are:

CVE-2021-27101 - Structured query language injection via a crafted HOST header (affecting FTA 9_12_370 and earlier)

CVE-2021-27102 - Operating system command execution via a local web service call (affecting FTA versions 9_12_411 and earlier)

CVE-2021-27103 - Server-side request forgery via a crafted POST request (affecting FTA 9_12_411 and earlier)

CVE-2021-27104 - Operating system command execution via a crafted POST request (affecting FTA 9_12_370 and earlier)

One of the exploited vulnerabilities (CVE-2021-27101) allows for an unauthenticated remote user to issue commands on targeted devices. After exploitation, the actor would then deploy a custom webshell. The webshell is a malicious PHP file, designed to be uploaded to a Accellion FTA server. The webshell uses a SQL injection vulnerability to install itself onto the affected webserver of the appliance. The webshell functionality includes the ability to issue commands to targeted devices, exfiltrate data, and clean up logs, specifically the Apache log files (for evasion and forensic purposes). Further observations include large amounts of data being transferred over port 443 to predetermined IP addresses.

What Platforms are Affected?

According to Accellion, the vulnerabilities are limited to the File Transfer Appliance. The Accellion's Kiteworks platform is unaffected.

How Serious of an Issue is This?

HIGH.

Are there Patches Available?

Yes. Please refer to the vendor homepage in the APPENDIX.

What is the Status of Coverage?

FortiGuard Labs has the following AV coverage in place for publicly known samples as:

PHP/Agent.B!tr

All Network IOC's related to this threat are blocked by the FortiGuard WebFiltering Client.

Any Other Suggested Mitigation?

Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.

Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.