Exploit Public-Facing Application

APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.^[8][9]

APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access. They have also exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.^[10][11][12]

APT39 has used SQL injection for initial compromise.^[13]

APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.^[14]

Axiom has been observed using SQL injection to gain access to systems.^[15][16]

BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers.^[17]

BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.^[18]

Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.^[19]

Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.^{[20][21][22][23][24]}

GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.^[25][26]

GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.^[27]

Havij is used to automate SQL injection.^[28]

menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.^[29]

Night Dragon has performed SQL injection attacks of extranet web servers to gain access.^[30]

Operation Wocao has gained initial access via vulnerable webservers.^[31]

Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.^[32][33]

Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.^[34]

SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.^[35]

sqlmap can be used to automate exploitation of SQL injection vulnerabilities.^[36]

Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.^{[37] [38]}

Application isolation will limit what other processes and system features the exploited target can access.

Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.

Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.

Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.

Update software regularly by employing patch management for externally exposed applications.

Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.^[6]