Threat Actors Hijacking MS-SQL Server to Deploy XiebroC2 Framework
A recent attack campaign has been identified targeting inadequately secured Microsoft SQL servers, utilizing the XiebroC2 command and control framework to gain persistent access to compromised systems.
A recent attack campaign has been identified targeting inadequately secured Microsoft SQL servers, utilizing the XiebroC2 command and control framework to gain persistent access to compromised systems.
The attack exploits vulnerable credentials on publicly accessible database servers, allowing attackers to establish an initial foothold and escalate privileges through a multi-stage deployment process.
XiebroC2 is a publicly available command and control framework that provides comprehensive remote control capabilities, including information gathering, defense evasion, and system manipulation, similar to other known tools.
The campaign follows known patterns observed in MS-SQL server attacks, beginning with credential-based intrusions and extending to coin mining operations. However, the integration of XiebroC2 marks a significant escalation in attack complexity, supporting cross-platform operations across Windows, Linux, and macOS environments.
The framework's open-source nature and extensive feature set make it a viable alternative to commercial penetration testing tools, offering capabilities such as reverse shells, file management, process control, and network monitoring without associated costs.
The campaign follows known patterns observed in MS-SQL server attacks, beginning with credential-based intrusions and extending to coin mining operations.
ASEC analysts have identified the malware during routine monitoring of attacks targeting MS-SQL servers, confirming the deployment of XiebroC2 alongside traditional coin mining payloads. The framework's implant component, developed in the Go programming language, incorporates advanced techniques for evading detection while maintaining communication with command and control infrastructure.
The attack methodology underscores the vulnerability of database servers that lack proper security hardening and access controls.
Privilege Escalation Through JuicyPotato Exploitation
The attack chain employs a systematic approach to privilege escalation through the deployment of JuicyPotato, an exploit tool that abuses Windows token privileges.
Upon successful authentication to the target MS-SQL server, attackers encounter the limitation of service account privileges, which typically operate with restricted access rights by design.
To overcome this constraint, threat actors use JuicyPotato to exploit specific token privileges within the current process account, elevating their access from service-level to administrative permissions. This privilege escalation technique leverages the impersonation privileges often granted to service accounts, enabling the exploit to spawn processes with elevated rights.
Once JuicyPotato escalates privileges, attackers proceed to download and execute the XiebroC2 framework using PowerShell commands. This method ensures that subsequent malicious activities operate with sufficient privileges to modify system configurations, install additional payloads, and establish persistent backdoors.
The configuration data reveals the framework's ability to collect comprehensive system information, including process identifiers, hardware identifiers, working directories, and user credentials, before establishing encrypted communication channels with the command and control server located at IP address 1.94.185.235 on port 8433.
Based on reporting by Cyber Security News.