Threat Signal Report

Praying Mantis: An advanced and persistent threat actor attacked prominent targets in the United States

Description

FortiGuard Labs is aware of a report that an advanced and persistent threat actor "Praying Mantis" targeted several high-profiled organizations in the United States. According to Sygia, a security company who investigated the attack, "the initial foothold within the network was obtained by leveraging a variety of deserialization exploits targeting Windows IIS servers and vulnerabilities targeting web applications." Upon successful entry, Praying Mantis deployed a backdoor malware for credential harvesting and reconnaissance. Based on similarities in the tactics, techniques, and procedures (TTPs), Praying Mantis and a threat actor responsible for attacking Australian private and public sectors in Copy-Paste compromises are thought to be the same actor.


When Did the Attack Occur?

Sygia stated that the attack occurred in the past year.


Who were the Targets of Praying Mantis?

The report indicated that high profiled organizations in the Untied States were targeted by Praying Mantis.


Is Another Name Assigned to Praying Mantis?

Yes, Praying Mantis is also called TG1021.


What was the Purpose of the Attack?

The purpose of the attack appeared to be potential reconnaissance for further attacks.


Which vulnerabilities were exploited by Praying Mantis to gain access to the targeted organizations?

The threat actor exploited the following vulnerabilities:


  • Checkbox Survey insecurely deserializes ASP.NET View State data (CVE-2021-27852)
  • Telerik UI Remote Code Execution (CVE-2019-18935)
  • Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization (CVE-2017-11317)


Have the vendors released the patch for the vulnerabilities?

Yes, the vendors have released respective patches.

For the patch details, please refer to the articles referenced in the Appendix.


Is this the Praying Mantis' First Act?

Based on similarities in the tactics, techniques, and procedures (TTPs), Praying Mantis and a threat actor responsible for attacking Australian private and public sectors in Copy-Paste compromises are thought to be the same actor.

For details on Copy-paste compromises, please refer to the advisory from Australian Cyber Security Center (ACSC) in the Appendix.


What is the Status of Coverage?

FortiGuard Labs has IPS coverage in place for the vulnerabilities:

  • Telerik.Web.UI.RadAsyncUpload.Handling.Arbitrary.File.Upload

The potential for damage to daily operations, reputation, and unwanted release of data, the disruption of business operations, etc. is apparent, and because of this it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed once available, and updated on a regular basis to protect against attackers establishing a foothold within a network.


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.