Trusted Design

Cisco Web VPNs Leveraged for Access and Persistence

概要

Last month at the CERT-EU Conference in Brussels, Belgium, Volexity gave a presentation on a recent evolution in how attackers are maintaining persistence within victim networks. The method, which involves modifying the login pages to Cisco Clientless SSL VPNs (Web VPN), is both novel and surprisingly obvious at the same time. Attackers have been able to successfully implant JavaScript code on the login pages that enables them to surreptitiously steal employee credentials as they login to access internal corporate resources.

Created: 2026-02-23

Indicators

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

Turla

Score: 24.34
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1612 - Build Image on Host
  • T1608.005 - Link Target
  • T1218.001 - Compiled HTML File
  • T1547.002 - Authentication Package
  • T1556.009 - Conditional Access Policies
  • T1578.001 - Create Snapshot
  • T1569.002 - Service Execution
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT32

Score: 9.17
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1612 - Build Image on Host
  • T1608.005 - Link Target
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Saint Bear

Score: 3.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
MITREへのリンク →

FIN6

Score: 4.50
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1612 - Build Image on Host
MITREへのリンク →

Sidewinder

Score: 4.57
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1578.001 - Create Snapshot
MITREへのリンク →

MuddyWater

Score: 6.38
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1547.002 - Authentication Package
MITREへのリンク →

Earth Lusca

Score: 7.61
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1218.001 - Compiled HTML File
MITREへのリンク →

Winter Vivern

Score: 10.13
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1548 - Abuse Elevation Control Mechanism
  • T1218.001 - Compiled HTML File
MITREへのリンク →

Contagious Interview

Score: 8.52
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1651 - Cloud Administration Command
MITREへのリンク →

LazyScripter

Score: 6.51
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1612 - Build Image on Host
  • T1608.005 - Link Target
MITREへのリンク →

FIN7

Score: 11.64
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1547.002 - Authentication Package
  • T1578.001 - Create Snapshot
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Higaisa

Score: 7.49
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1578.001 - Create Snapshot
  • T1569.002 - Service Execution
MITREへのリンク →

Kimsuky

Score: 27.45
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1123 - Audio Capture
  • T1109 - Component Firmware
  • T1536 - Revert Cloud Instance
  • T1546.008 - Accessibility Features
  • T1608.005 - Link Target
  • T1547.002 - Authentication Package
  • T1526 - Cloud Service Discovery
  • T1008 - Fallback Channels
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Mustang Panda

Score: 9.66
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1612 - Build Image on Host
  • T1608.005 - Link Target
  • T1526 - Cloud Service Discovery
MITREへのリンク →

TA578

Score: 3.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
MITREへのリンク →

Evilnum

Score: 5.01
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
MITREへのリンク →

Star Blizzard

Score: 9.54
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
  • T1168 - Local Job Scheduling
MITREへのリンク →

TeamTNT

Score: 4.46
Matched TTPs:
  • T1123 - Audio Capture
  • T1612 - Build Image on Host
MITREへのリンク →

FIN13

Score: 12.55
Matched TTPs:
  • T1123 - Audio Capture
  • T1536 - Revert Cloud Instance
  • T1686.001 - Cloud Firewall
  • T1569.002 - Service Execution
MITREへのリンク →

Ember Bear

Score: 5.78
Matched TTPs:
  • T1123 - Audio Capture
  • T1589 - Gather Victim Identity Information
MITREへのリンク →

Sandworm Team

Score: 11.21
Matched TTPs:
  • T1123 - Audio Capture
  • T1109 - Component Firmware
  • T1546.008 - Accessibility Features
  • T1547.002 - Authentication Package
MITREへのリンク →

Volt Typhoon

Score: 11.08
Matched TTPs:
  • T1123 - Audio Capture
  • T1685.001 - Disable or Modify Windows Event Log
  • T1578.001 - Create Snapshot
  • T1569.002 - Service Execution
MITREへのリンク →

Velvet Ant

Score: 7.53
Matched TTPs:
  • T1123 - Audio Capture
  • T1569.002 - Service Execution
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Scattered Spider

Score: 13.23
Matched TTPs:
  • T1123 - Audio Capture
  • T1109 - Component Firmware
  • T1619 - Cloud Storage Object Discovery
  • T1557.002 - ARP Cache Poisoning
MITREへのリンク →

APT41

Score: 8.37
Matched TTPs:
  • T1123 - Audio Capture
  • T1536 - Revert Cloud Instance
  • T1008 - Fallback Channels
MITREへのリンク →

LAPSUS$

Score: 10.20
Matched TTPs:
  • T1123 - Audio Capture
  • T1619 - Cloud Storage Object Discovery
  • T1557.002 - ARP Cache Poisoning
MITREへのリンク →

OilRig

Score: 13.25
Matched TTPs:
  • T1123 - Audio Capture
  • T1592.002 - Software
  • T1556.009 - Conditional Access Policies
  • T1526 - Cloud Service Discovery
MITREへのリンク →

Wizard Spider

Score: 12.55
Matched TTPs:
  • T1123 - Audio Capture
  • T1589 - Gather Victim Identity Information
  • T1556.009 - Conditional Access Policies
  • T1526 - Cloud Service Discovery
MITREへのリンク →

APT29

Score: 14.37
Matched TTPs:
  • T1123 - Audio Capture
  • T1608.005 - Link Target
  • T1683 - Generate Content
  • T1608.006 - SEO Poisoning
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Threat Group-3390

Score: 5.09
Matched TTPs:
  • T1123 - Audio Capture
  • T1526 - Cloud Service Discovery
MITREへのリンク →

Sea Turtle

Score: 4.60
Matched TTPs:
  • T1123 - Audio Capture
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Chimera

Score: 4.53
Matched TTPs:
  • T1123 - Audio Capture
  • T1578.001 - Create Snapshot
MITREへのリンク →

Dragonfly

Score: 5.09
Matched TTPs:
  • T1123 - Audio Capture
  • T1536 - Revert Cloud Instance
MITREへのリンク →

APT28

Score: 14.51
Matched TTPs:
  • T1123 - Audio Capture
  • T1685.001 - Disable or Modify Windows Event Log
  • T1608.005 - Link Target
  • T1547.002 - Authentication Package
  • T1546.007 - Netsh Helper DLL
MITREへのリンク →

Play

Score: 4.60
Matched TTPs:
  • T1123 - Audio Capture
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Leviathan

Score: 9.69
Matched TTPs:
  • T1123 - Audio Capture
  • T1685.001 - Disable or Modify Windows Event Log
  • T1554 - Compromise Host Software Binary
MITREへのリンク →

LuminousMoth

Score: 3.03
Matched TTPs:
  • T1109 - Component Firmware
MITREへのリンク →

Lotus Blossom

Score: 5.96
Matched TTPs:
  • T1109 - Component Firmware
  • T1569.002 - Service Execution
MITREへのリンク →

APT42

Score: 9.40
Matched TTPs:
  • T1109 - Component Firmware
  • T1612 - Build Image on Host
  • T1599 - Network Boundary Bridging
MITREへのリンク →

ZIRCONIUM

Score: 14.76
Matched TTPs:
  • T1685.001 - Disable or Modify Windows Event Log
  • T1608.005 - Link Target
  • T1547.002 - Authentication Package
  • T1608.006 - SEO Poisoning
  • T1578.001 - Create Snapshot
MITREへのリンク →

APT3

Score: 3.15
Matched TTPs:
  • T1536 - Revert Cloud Instance
MITREへのリンク →

Magic Hound

Score: 11.18
Matched TTPs:
  • T1536 - Revert Cloud Instance
  • T1608.005 - Link Target
  • T1683 - Generate Content
  • T1547.002 - Authentication Package
MITREへのリンク →

APT5

Score: 3.15
Matched TTPs:
  • T1536 - Revert Cloud Instance
MITREへのリンク →

Aquatic Panda

Score: 3.84
Matched TTPs:
  • T1589 - Gather Victim Identity Information
MITREへのリンク →

Silent Librarian

Score: 3.84
Matched TTPs:
  • T1546.008 - Accessibility Features
MITREへのリンク →

Rocke

Score: 5.81
Matched TTPs:
  • T1612 - Build Image on Host
  • T1008 - Fallback Channels
MITREへのリンク →

FIN8

Score: 5.67
Matched TTPs:
  • T1612 - Build Image on Host
  • T1526 - Cloud Service Discovery
MITREへのリンク →

Gamaredon Group

Score: 11.07
Matched TTPs:
  • T1612 - Build Image on Host
  • T1608.005 - Link Target
  • T1554 - Compromise Host Software Binary
  • T1547.002 - Authentication Package
MITREへのリンク →

HAFNIUM

Score: 4.68
Matched TTPs:
  • T1608.005 - Link Target
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Lazarus Group

Score: 9.93
Matched TTPs:
  • T1608.005 - Link Target
  • T1547.002 - Authentication Package
  • T1578.001 - Create Snapshot
  • T1569.002 - Service Execution
MITREへのリンク →

POLONIUM

Score: 4.41
Matched TTPs:
  • T1608.005 - Link Target
  • T1547.002 - Authentication Package
MITREへのリンク →

CURIUM

Score: 6.21
Matched TTPs:
  • T1218.001 - Compiled HTML File
  • T1578.001 - Create Snapshot
MITREへのリンク →

Tropic Trooper

Score: 6.29
Matched TTPs:
  • T1683 - Generate Content
  • T1490 - Inhibit System Recovery
MITREへのリンク →

BITTER

Score: 3.62
Matched TTPs:
  • T1683 - Generate Content
MITREへのリンク →

Storm-1811

Score: 3.84
Matched TTPs:
  • T1599 - Network Boundary Bridging
MITREへのリンク →

APT39

Score: 9.17
Matched TTPs:
  • T1599 - Network Boundary Bridging
  • T1547.002 - Authentication Package
  • T1569.002 - Service Execution
MITREへのリンク →

Stealth Falcon

Score: 3.62
Matched TTPs:
  • T1556.009 - Conditional Access Policies
MITREへのリンク →

BlackTech

Score: 3.15
Matched TTPs:
  • T1526 - Cloud Service Discovery
MITREへのリンク →

BRONZE BUTLER

Score: 5.88
Matched TTPs:
  • T1578.001 - Create Snapshot
  • T1008 - Fallback Channels
MITREへのリンク →

RTM

Score: 3.29
Matched TTPs:
  • T1008 - Fallback Channels
MITREへのリンク →

Patchwork

Score: 3.29
Matched TTPs:
  • T1008 - Fallback Channels
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.77
Matched TTPs:
  • T1536 - Revert Cloud Instance
  • T1546.008 - Accessibility Features
  • T1123 - Audio Capture
  • T1526 - Cloud Service Discovery
  • T1109 - Component Firmware
  • T1608.005 - Link Target
  • T1546.013 - PowerShell Profile
  • T1008 - Fallback Channels
  • T1490 - Inhibit System Recovery
  • T1547.002 - Authentication Package
MITREへのリンク →

Turla

Score: 0.69
Matched TTPs:
  • T1612 - Build Image on Host
  • T1218.001 - Compiled HTML File
  • T1556.009 - Conditional Access Policies
  • T1608.005 - Link Target
  • T1546.013 - PowerShell Profile
  • T1490 - Inhibit System Recovery
  • T1569.002 - Service Execution
  • T1547.002 - Authentication Package
  • T1578.001 - Create Snapshot
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る