Hackers group Lebanese Cedar attack unpatched Atlassian servers at telcoms, Hosting and ISPs providers.

Lebanese Cedar

A volatile hacker group “Lebanese Cedar” linked to Lebanese Hezbollah Cyber Unit, has more advanced technological skill than previously thought.

Over the past decade, companies in the US, UK, Egypt, Jordan, Lebanon, Israel have been targeted by this group.

Israeli cybersecurity firm — ClearSky in a report on Thursday, found at least 250 web servers have been hacked by the group.

However, Lebanese Cedar group focus on collecting intelligence and stealing company databases with sensitive information.

In addition, the information includes:

• client call records
• and, private data in the case of telecommunications companies.

Attack Workflow:

Clearsky researchers said the attacks followed a simple pattern.

According to the researchers, threat actors used open-source hacking tools to scan the internet for unpatched Atlassian and Oracle servers.

In follow, hackers performed exploits to gain access to the server and install a web shell for future access.

And, Web shells such as:

• ASPXSpy
• Caterpillar 2
• Mamad Warning
• and, an open-source tool named JSP file browser (which can also function as a web shell).

After that, Lebanese Cedar deployed the payload of Explosive RAT into the victims’ network.

According to ClearSky, Lebanese Cedar is the only known threat actor that uses this code, which comes with capabilities to record keystrokes, capture screenshots, and execute arbitrary commands.

Clearsky said the hackers used three flaws in the servers such as:

• CVE-2019-3396 in Atlassian Confluence 
• CVE-2019-11581 in Atlassian Jira
• CVE-2012-3152 in Oracle Fusion

Indicators Of Compromise:

ClearSky Lebanese Cedar report’s PDF contains data including indicators of compromise and more technical details.

Hash Values:

IP Address:

• 68.65.122[.]109
• 74.208.73[.]149
• 191.101.5[.]183
• 198.101.242[.]72
• 169.50.13[.]61