The researchers also discovered that the attackers had access to a pre-configured installer script on their C2 server that could deploy a full suite of adversarial tools and frameworks hosted on an Alibaba cloud container Registry, indicating potential future attack capabilities beyond credential harvesting. After gaining initial access, the attackers deploy a PowerShell injector script containing either base64-encoded or hexadecimal data blob of Cobalt Strike reverse HTTP shellcode. They also abuse Group Policy Objects using “SharpGPOAbuse.exe” to execute malicious PowerShell scripts across the network and ultimately execute Mimikatz commands to dump and exfiltrate passwords and NTLM hashes from the victim’s machine memory. To exploit this vulnerability, the attackers utilize a publicly available Python script called “PHP-CGI_CVE-2024-4577_RCE.py” that sends specifically crafted POST requests to target URLs. Upon confirmation, the attackers execute PowerShell commands through PHP code to download and run a PowerShell injector script from their command and control (C2) server. The PHP-CGI module misinterprets these characters as PHP options, enabling attackers to execute arbitrary PHP code on vulnerable servers running Apache with a vulnerable PHP-CGI setup. The malicious activities conducted by unknown attackers have been ongoing since January 2025, predominantly targeting organizations in Japan across various business sectors including technology, telecommunications, entertainment, education, and e-commerce. The attacker’s tradecraft has similarities with techniques used by a hacker group called “Dark Cloud Shield” or “You Dun” in their 2024 attacks, although they are not attributing the current campaign to this group based on current evidence. The attackers are exploiting CVE-2024-4577, a remote code execution vulnerability in the PHP-CGI implementation of PHP on Windows systems. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Cisco Talos analysts identified that the attack chain begins with this initial exploitation, followed by privilege escalation, persistence establishment, detection evasion, lateral movement, and credential theft. This critical flaw stems from the “Best-Fit” behavior in Windows code pages, where certain characters in command-line inputs are replaced. The script checks if a URL is vulnerable by looking for the MD5 hash “e10adc3949ba59abbe56e057f20f883e” in the response, indicating successful exploitation. For post-exploitation activities, the attackers utilize plugins from the “TaoWu” Cobalt Strike kit.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Mar 2025 09:35:16 +0000