Log4j exploit targets vulnerable Unifi network application (Ubiquiti)

(We recommend that you identify PowerShell execution as a child process of this command line execution instruction)

Origin:

https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/prompt/powershell_reverse_tcp_prompt.ps1

We found that the C2 used in the attack had already been noted as part of the SolarWind supply chain attack, the Cobalt C2 beacon, and was attributed to TA505 aka GRACEFUL SPIDER, a well-known group of financially motivated threat actors. These attacks are often motivated by opportunities to sell sensitive data or launch ransomware demands to avoid exposure. TA505, the name given by point of proof, has worked in the area of ​​cybercrime for at least five years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, distributed through malicious email campaigns via the Necurs botnet. Other malware associated with TA505 includes Philadelphia and GlobeImposter ransomware families. Learn more about TA505 here.

These types of attacks show how traditional security solutions fail to detect and prevent newer threats, which have become much more frequent and sophisticated. With an average ransomware attack now occurring every few seconds and ransoms costing organizations millions, security teams must explore ways to augment or replace current solutions that are no longer adequate. Leading analysts, such as Gartner, point to Moving Target Defense as a way to detect and prevent attacks that now bypass next-generation antivirus (NGAV) solutions and endpoint detection and response (EDR) solutions. Organizations should also consider incident response (IR) services, not only to respond to indicators of compromise (IOCs), but also to assess security postures to detect weaknesses and provide recommendations for improving defenses.

Related Tweet on C2: