Unsecurity Episode 198: New APT Compromise Strategy, Threat Actors Exploit 3-Year-Old Vulnerability

### Overview In this episode of the Unsecurity podcast, host Oscar Minks and co-host Brad Nye discuss ongoing security events, starting with recent zero-day activity affecting Adobe ColdFusion and a breach of a U.S. federal agency involving a years-old Telerik vulnerability. They also examine an emerging shift in advanced persistent threat (APT) tactics away from destructive ransomware encryption toward silent data exfiltration and extortion, highlighting the critical need for baseline normalization and threat hunting beyond mere patch application.

### Key Topics - **Adobe ColdFusion Zero-Day Bug:** A newly reported zero-day bug affecting Adobe ColdFusion allows remote code execution (arbitrary code execution and arbitrary file system read) with low technical complexity and no user interaction. Patches have been released for ColdFusion 2018 (Update 16) and ColdFusion 2021 (Update 6), while older versions (ColdFusion 11 and 2016) remain vulnerable. - **Breach of a U.S. Federal Agency:** Discussion of a compromise occurring between November 2022 and January 2023 caused by a known Telerik web server plugin vulnerability dating back to 2019. Threat actors gained access to the web server, dropped malicious DLLs into the Windows temp directory, and masqueraded malicious payloads. - **Evolving APT Compromise Strategies:** Rather than deploying noisy, destructive ransomware encrypters that draw law enforcement and regulatory scrutiny, some threat groups are shifting toward stealthy data theft. They sneak in, exfiltrate data, leave persistence mechanisms, wait for forensic logs to roll over, and subsequently demand ransom under threat of public disclosure or data sale. - **Security Baselines and Normalization:** Emphasizing the mantra 'know normal, find evil,' the hosts discuss the importance of understanding baseline system activity, SIEM tuning, asset inventory, and service account privileges.

### Technical Details - **Spray-and-Pray & Persistence:** Following the release of public proof-of-concept exploits, threat actors conduct mass scans for web applications running ColdFusion to execute remote code execution and drop shells. Rather than proceeding to tertiary attack stages immediately, attackers often prioritize establishing persistent footholds across as many targets as possible. - **Forensic Timelining:** Merely applying a security update does not remediate pre-existing compromises. Defenders should conduct threat hunting using timelining techniques. On Windows systems, analyzing the Master File Table (MFT) for file creation and birth timestamps (C and B records) within web directories (root web locations) and temporary folders (such as Windows temp) can uncover unauthorized files or reverse shells (e.g., suspicious executables like `reverse shell.exe` or `multi OS reverse shell.exe`). - **Process & Payload Masquerading:** In the federal agency incident, malicious DLL files were disguised as PNG files and executed within the context of the IIS worker process (`w3wp.exe`). These payloads enumerated system info, loaded extra libraries, tracked files and processes, and exfiltrated data without spawning obvious child processes. - **Service Account Hardening:** Web services should not run under administrative privileges, as an attacker executing a web shell inherits the context and rights of that underlying service account.

### Takeaways - **Patching Is Not Sufficient:** When remote code execution vulnerabilities on internet-facing assets are exploited in the wild, organizations must actively hunt their environments for persistence artifacts rather than simply applying patches. - **Focus on the Basics Over Silver-Bullet Tools:** Effective defense relies on baseline visibility, inventory management, least-privilege configurations, and log retention rather than relying entirely on endpoint detection tools, which can fail to detect stealthy exfiltration.