A sudden and significant decrease in the number of compromised Cisco IOS XE devices visible on the Internet has triggered speculation and theories among security researchers and experts. The unexpected drop fueled discussions about possible causes, leading researchers from Fox-IT to investigate and identify the true reason behind this phenomenon.
Research Findings
After thorough investigation, Fox-IT researchers discovered that the attacker responsible for compromising the Cisco devices had simply altered the implant. This unexpected move puzzled experts and raised questions about the attacker’s motivations.
Exploit Chain and Vulnerability Details
The primary bug exploited in this attack resides in the Web User Interface (UI) of IOS XE, providing unauthenticated, remote attackers with initial access to vulnerable devices. By exploiting this vulnerability, attackers were able to gain a foothold on the compromised devices. However, the attack method also involved a second zero-day vulnerability, permitting the attacker to elevate their privileges to root and write an implant onto the file system.
Initial Reports of Widespread Infection
In response to the sudden decrease in compromised devices, security researchers previously reported witnessing a single threat actor infecting tens of thousands of Cisco IOS XE devices with an implant specifically designed for arbitrary code execution. This widespread infection raised concerns about the potential impact and compromised security within affected organizations.
Speculation Around the Sudden Drop
Given the significant decrease in compromised systems, speculation grew over the possibility of an unknown grey-hat hacker silently removing the attacker’s implant from the infected devices. This theory suggested a potential countermeasure aimed at neutralizing the threat and protecting the compromised systems. However, this speculation was proven inaccurate as subsequent investigations unveiled the truth behind the drop.
Actual Number of Compromised Devices
Contrary to speculation, Fox-IT’s research revealed that approximately 38,000 Cisco IOS XE devices remain compromised due to the two recently disclosed zero-day vulnerabilities. This number highlights the extensive reach and impact of the attack on vulnerable systems globally.
Altered Implant Behavior
Significantly, the attacker had modified the implant’s behavior to include a check for an Authorization HTTP header value before responding. This alteration reveals an unexpected level of sophistication, suggesting that the attacker is actively seeking to evade detection while maintaining control over the compromised devices.
Identification of Remaining Compromised Devices
Utilizing alternative fingerprinting methods, Fox-IT was able to identify the 37,890 devices that still harbor the attacker’s implant. This discovery raises further concerns about the attacker’s capabilities and the potential risks associated with the compromised systems.
Puzzling Motivations of the Attacker
The motivations behind the attacker’s decision to alter the implant and maintain control over compromised Cisco IOS XE devices remain puzzling and unexpected. The modification reflects an extra layer of complexity, indicating a higher level of determination and sophistication than initially anticipated. Further investigation is necessary to fully comprehend the attacker’s objectives and potential implications.
The sharp decrease in the number of compromised Cisco IOS XE devices visible on the Internet, which initially led to speculation about a grey-hat hacker, has been revealed as the result of the attacker modifying the implant. With approximately 38,000 devices still compromised worldwide, it is crucial for affected organizations to take immediate action to assess and remediate the security vulnerabilities. The attacker’s motivations and their unexpected alteration of the implant raise concerns about the long-term implications, emphasizing the need for continued vigilance and proactive security measures.