{"id":18289,"date":"2022-02-16T06:33:03","date_gmt":"2022-02-16T14:33:03","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/02\/16\/news-12022\/"},"modified":"2022-02-16T06:33:03","modified_gmt":"2022-02-16T14:33:03","slug":"news-12022","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/02\/16\/news-12022\/","title":{"rendered":"Guard Your Drive from DriveGuard: Moses Staff Campaigns Against Israeli Organizations Span Several Months"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

FortiGuard Labs<\/a>\u00a0Research<\/h2>\n

Affected Platforms:<\/b> Windows
Impacted Users:<\/b> Windows Users
Impact: <\/b>Data theft and execution of additional malicious payloads
Severity Level: <\/b>Critical <\/p>\n

Over the past year, FortiEDR has prevented multiple attacks that attempted to exploit various Microsoft Exchange server vulnerabilities, some of which we have previously covered<\/a>.<\/p>\n

Among these attacks, we identified a campaign operated by Moses Staff, a geo-political motivated threat group believed to be sponsored by the Iranian government. After tracking this campaign for the last several months we found that the group has been using a custom multi-component toolset for the purpose of conducting espionage against its victims.<\/p>\n

This campaign exclusively targets Israeli organizations. Close examination reveals that the group has been active for over a year, much earlier than the group\u2019s first official public exposure, managing to stay under the radar with an extremely low detection rate.<\/p>\n

In this blog, we will cover the Techniques, Tactics, and Procedures (TTPs) used by Moses Staff and reveal a new backdoor used by them to download files, execute payloads, and exfiltrate data from target networks, along with threat intelligence data on their activities.<\/p>\n

Infection Vector<\/h3>\n

The initial infiltration was accomplished by leveraging the ProxyShell<\/a> exploit in Microsoft Exchange servers to allow an unauthenticated attacker to execute arbitrary commands on them through an exposed HTTPS port. As a result, the attackers were able to deploy two web shells:<\/p>\n