Analysis of the directory’s contents revealed that initial access to victim networks was primarily achieved through compromised SonicWall VPN credentials, followed by systematic exploitation of Active Directory environments to gain domain administrator privileges. The discovery of this directory provides valuable intelligence for organizations seeking to protect themselves against the Fog ransomware group and highlights the importance of securing VPN credentials and monitoring for unauthorized remote access tools. Cybersecurity analysts have uncovered an open directory linked to the Fog ransomware group, revealing a comprehensive toolkit used by threat actors to compromise corporate networks. These tools enable threat actors to quickly escalate privileges within compromised environments, moving from initial access to domain dominance in relatively short timeframes. What makes this discovery particularly concerning is the comprehensive nature of the toolkit, which includes multiple exploits for Active Directory vulnerabilities such as Zerologon (CVE-2020-1472) and domain controller impersonation flaws (CVE-2021-42278 and CVE-2021-42287). The directory, discovered in December 2024 and hosted at IP address 194.48.154.79:80, contains an arsenal of tools designed for reconnaissance, exploitation, lateral movement, and persistence within victim environments. The script, found in a file named “sonic_scan/main.py,” automates the authentication process to SonicWall VPN appliances and executes port scans to identify potential entry points into victim networks. The DFIR Report analysts identified a Python script within the directory specifically designed to test compromised SonicWall VPN credentials. The toolkit also includes specialized credential theft utilities like DonPAPI, which can extract Windows Data Protection API (DPAPI) protected credentials from various sources, including browser passwords, cookies, certificates, and Windows credential manager. This approach ensures the threat actors maintain access to compromised systems even if their initial entry point is remediated. By using the official AnyDesk download and implementing it with startup parameters, the threat actors create a backdoor that appears as normal remote support software to many detection systems.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 28 Apr 2025 07:20:11 +0000