Technique:  Exploit Public-Facing Application
It has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.
It has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.
It has used SQL injection for initial compromise.
It exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.
It has been observed using SQL injection to gain access to systems.
It has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. It has also exploited mis-configured Plesk servers.
It has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.
It has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.
During C0017, It exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.
During C0018, the threat actors exploited VMWare Horizon Unified Access Gateways that were vulnerable to several Log4Shell vulnerabilities, including CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832.
During C0027, It exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access.
It has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.
It has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.
It has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.
It has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.
It exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.
It has exploited Oracle WebLogic vulnerabilities for initial compromise.
It has exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server, enabling access to email accounts and installation of additional malware.
Havij is used to automate SQL injection.
It has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.
It has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.
It has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).
It has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.
It has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.
It has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).
During Night Dragon, threat actors used SQL injection exploits against extranet web servers to gain access.
During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.
During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.
It exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.
Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.
During the SolarWinds Compromise, It exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.
SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.
sqlmap can be used to automate exploitation of SQL injection vulnerabilities.
It has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.
It has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.
It gained initial access through exploitation of CVE-2021-40539 in internet-facing ManageEngine ADSelfService Plus servers.
ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.