Web Application Attacks Surge: Talos IR Reports Q3 2023 Threat Landscape

Quarterly Threat Report: Telecommunications and Education Most-Affected

The third quarter of 2023 has seen a marked escalation in web application attacks, which now account for a substantial 30 percent of the response engagements conducted by Cisco Talos Incident Response (Talos IR), a stark contrast to just 8 percent in the previous quarter. This shift underscores the urgent need for stakeholders to reassess their security postures.

Exploitation of public-facing applications has emerged as the primary vector for initial access, equally responsible for 30 percent of total engagements. The sharp rise in web application attacks likely contributed significantly to this increase.

Ransomware threats persist at a significant level, representing 10 percent of engagements. The third quarter saw familiar ransomware families like LockBit and BlackByte; notably, a new variation, BlackByte NT, made its debut.

Telecommunications and educational sectors stood out as the most targeted industries, each contributing to 20 percent of all incidents. The telecommunications sector continuously attracts threat actors due to its essential infrastructure role and the wealth of sensitive customer data it holds. Similarly, educational institutions, often constrained by limited cybersecurity budgets, hold rich personally identifiable information that cybercriminals find appealing.

Rise in Web Application Targeting

Web application attacks have emerged as the dominant threat type in Q3, comprising 30 percent of all Talos IR engagements. Following initial access, attackers frequently deployed techniques such as web injection attacks, the installation of web shells, and the exploitation of toolkits like Supershell to maintain ongoing access. This quarter, the Supershell command and control (C2) framework has gained attention for its ability to exploit vulnerabilities in web servers effectively.

Supershell provides adversaries with a comprehensive management interface, facilitating command execution and system management from remote locations. Adversaries typically initiate their attack by executing XML external entity (XXE) injection attacks to exploit poorly configured XML parsers, increasing the chances of successful compromise.

This evolving landscape illustrates a concerning trend: while sophisticated frameworks lower the barriers for more advanced threat actors, they simultaneously open the door to less experienced attackers. The emergence of frameworks like Alchimist and Manjusaka suggests that this pattern will likely persist as cybercriminals continue to augment their capabilities to carry out web-based assaults.

Web shells, which act as malicious scripts enabling server compromise, posed significant threats. Talos IR documented engagements where attackers uploaded multiple PHP shells to unpatched servers. However, effective defenses such as Web Application Firewalls (WAFs) were also observed to halt the attackers, emphasizing the defensive value of proper application security measures.

This quarter also revealed a rise in SQL injection (SQLi) attacks, evidenced by numerous instances of adversaries employing SQLMap to exploit unvalidated input fields. Talos IR noted that tools like Nessus were also used to probe for SQLi vulnerabilities to extend attackers' access within environments.

Persistent Ransomware Threats

Ransomware remains a significant player in the threat landscape, accounting for 10 percent of total incident response engagements. Notable was the introduction of the BlackByte NT variant alongside the ongoing activity of LockBit, which has established itself as one of the predominantly active ransomware families since September 2022.

In one incident involving LockBit, attackers leveraged a valid contractor account to infiltrate the system. They efficiently executed privilege escalation tactics by dumping credentials, establishing unauthorized administrator accounts, and evading detection through log clearing and disabling security solutions.

The newly observed variant, BlackByte NT, adds complexity to the ransomware landscape as it is entirely coded in C++, which presents distinct operational challenges for defenders. It also follows similar initial attack vectors through compromised accounts, demonstrating a trend towards more sophisticated and evasive methodologies.

Emerging Threat Actors: ShroudedSnooper

This quarter, Talos IR identified a new advanced persistent threat (APT) group known as ShroudedSnooper, which targets telecommunications entities in the Middle East. This underscores a continued focus on telecommunications firms by sophisticated actors. ShroudedSnooper has employed innovative backdoors dubbed “HTTPSnoop” and “PipeSnoop,” allowing for prolonged and covert access to compromised systems.

These backdoors integrate with Windows HTTP kernel drivers to monitor specific HTTP(S) requests, creating a stealthy access point for attackers. Disturbingly, these implants masquerade as legitimate security-related software, further complicating detection efforts.

Initial Vectors and Security Weaknesses

As the report indicates, exploitation of public-facing applications remains the predominant means of gaining initial access, accounting for 30 percent of engagements during Q3. This alarming statistic emphasizes the urgent need for improved web application security.

Talos IR identified significant security concerns: unpatched applications and misconfigurations were linked to 40 percent of engagements each. A lack of multi-factor authentication (MFA) on critical services such as RDP often paves the way for successful attacks. Establishing MFA for all user accounts—employee or contractor—is a fundamental recommendation.

Furthermore, timely software updates and rigorous patch management are critical in mitigating vulnerabilities. Organizations must prioritize critical vulnerabilities that pose imminent risks while ensuring comprehensive vulnerability management strategies are in place.

Misconfigurations remain a pervasive issue, often allowing adversaries to exploit publicly exposed vulnerabilities. Organizations are encouraged to proactively configure both systems and deployment tools meticulously, reducing the avenues for successful attacks.

Top Observed MITRE ATT&CK Techniques

Key findings from Talos IR's report reveal several prevalent techniques employed by attackers, categorized within the MITRE ATT&CK framework. Notable insights include:

• 30 percent of engagements involved exploitation of public-facing applications.
• 25 percent of incidents used remote services like RDP for lateral movement.
• AnyDesk was evident in all ransomware and pre-ransomware incidents, highlighting its integral role in attack chains.
• Indicator removal strategies, such as clearing Windows event logs, were frequently observed as evasion techniques.
• Persistent execution of malicious code via scheduled tasks was noted in 25 percent of engagements.

As organizations navigate the complexities of the evolving attack landscape, these findings serve as a critical reminder of the need for vigilant security practices and proactive risk management strategies to mitigate the myriad threats they face.