Hello, welcome to the Monday, May 16th, 2020 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and we're recording from Jacksonville, Florida.

Well, we got a couple good diaries for the weekend. Let's start with Friday. Friday I wrote up a quick review of all the different

exploits that we have seen over the last week for the big IP vulnerability CVE 2022-1388.

So it was just about a week earlier that we learned about the vulnerability.

Researchers were pretty quickly announcing that they found exploits for the vulnerability,

but took till Monday morning for actually an exploit to become public

and the actual exploitation of the vulnerability to start.

We saw a real fast ramp up in exploitation attempts, first starting with some simple

ID and Who Am I, checks to basically profile the system, then immediately followed by

back doors and web shells that were installed, including the couple

destructive tags that we noted earlier. Finally, on Thursday then, we did see how the Mirai

Botnet actually incorporated this particular exploit. We recovered it in a sample that hit one of our

undergradiate interns honeypots. So what this really means is that the vulnerability sort of has

run its course. At this point, you should expect that pretty much every war-able system has been exploited.

There hasn't been a lot sort of what I would consider targeted.

Like only very few exploit attempts, for example, took advantage of specific big IP commands.

For the most part, they just treated it like a Linux system, which of course it is and ran basic Linux exploits.

In some cases, just copying, for example, web shells into the appropriate directory.

Also pretty much no patching happening by the attackers, which of course then leads to a multiple exploitation of the same system.

If you do have a vulnerable exposed F5 big IP device in your network,

assume that it has been compromised multiple times by now.

Now another thing that we didn't see and probably wouldn't really see well in our honeypots

...