Explosive Remote Access Trojan and Caterpillar Web Shell
New versions of Explosive RAT and Caterpillar Web Shell have been observed in a recent campaign by the long-running and evasive Lebanese Cedar APT, also known as Volatile Cedar.
Summary
New versions of Explosive RAT and Caterpillar Web Shell have been observed in a recent campaign by the long-running and evasive Lebanese Cedar APT, also known as Volatile Cedar.
Affected platforms
The following platforms are known to be affected:
Oracle and Atlassian web servers
Threat details
Introduction
Explosive Remote Access Trojan (RAT) and Caterpillar Web Shell are malware tools custom-built by the Lebanese Cedar Advanced Persistent Threat (APT) group, also known as Volatile Cedar. Security researchers have observed Explosive and Caterpillar deployed by Lebanese Cedar alongside open-source tools in a recent campaign targeting vulnerable Oracle and Atlassian web servers.
Lebanese Cedar has operated since 2012 and was initially exposed in 2015, but they avoided further attention from security researchers until early 2021.
Delivery
Explosive and Caterpillar are delivered remotely by exploiting known vulnerabilities in unpatched public-facing Oracle and Atlassian web servers. Known exploits include CVE-2019-3396, CVE-2019-11581 and CVE-2012-3152 which affect Atlassian Confluence, Atlassian Jira and Oracle Fusion Middleware.
Activities
Extensive reconnaissance is carried out when a web server has been compromised. Caterpillar is used to collect network information and install additional files, while Explosive is used to steal sensitive information. Lebanese Cedar evades detection by using common utilities, changing attack methodologies and ceasing operations for long periods of time.
Remediation advice
Public-facing Oracle and Atlassian web servers should be checked for unusual activity and to ensure all available security updates have been applied. To help prevent and detect an infection, NHS Digital also advises that:
- Secure configurations are applied to all devices.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Indicators of compromise
CVE Vulnerabilities
Last edited: 21 December 2021 9:57 am