Trusted Design

Cisco Web VPNs Leveraged for Access and Persistence

概要

Last month at the CERT-EU Conference in Brussels, Belgium, Volexity gave a presentation on a recent evolution in how attackers are maintaining persistence within victim networks. The method, which involves modifying the login pages to Cisco Clientless SSL VPNs (Web VPN), is both novel and surprisingly obvious at the same time. Attackers have been able to successfully implant JavaScript code on the login pages that enables them to surreptitiously steal employee credentials as they login to access internal corporate resources.

Created: 2026-02-23

Indicators

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

Turla

Score: 24.34
Matched TTPs:
  • T1059.007 - JavaScript
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1584.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1555.004 - Windows Credential Manager
  • T1124 - System Time Discovery
  • T1090.001 - Internal Proxy
  • T1078.003 - Local Accounts
MITREへのリンク →

APT32

Score: 9.17
Matched TTPs:
  • T1059.007 - JavaScript
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1078.003 - Local Accounts
MITREへのリンク →

Saint Bear

Score: 3.99
Matched TTPs:
  • T1059.007 - JavaScript
  • T1583.006 - Web Services
MITREへのリンク →

FIN6

Score: 4.50
Matched TTPs:
  • T1059.007 - JavaScript
  • T1102 - Web Service
MITREへのリンク →

Sidewinder

Score: 4.57
Matched TTPs:
  • T1059.007 - JavaScript
  • T1124 - System Time Discovery
MITREへのリンク →

MuddyWater

Score: 6.38
Matched TTPs:
  • T1059.007 - JavaScript
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Earth Lusca

Score: 7.61
Matched TTPs:
  • T1059.007 - JavaScript
  • T1583.006 - Web Services
  • T1584.006 - Web Services
MITREへのリンク →

Winter Vivern

Score: 10.13
Matched TTPs:
  • T1059.007 - JavaScript
  • T1056.003 - Web Portal Capture
  • T1584.006 - Web Services
MITREへのリンク →

Contagious Interview

Score: 8.52
Matched TTPs:
  • T1059.007 - JavaScript
  • T1583.006 - Web Services
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

LazyScripter

Score: 6.51
Matched TTPs:
  • T1059.007 - JavaScript
  • T1102 - Web Service
  • T1583.006 - Web Services
MITREへのリンク →

FIN7

Score: 11.64
Matched TTPs:
  • T1059.007 - JavaScript
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1124 - System Time Discovery
  • T1078.003 - Local Accounts
MITREへのリンク →

Higaisa

Score: 7.49
Matched TTPs:
  • T1059.007 - JavaScript
  • T1124 - System Time Discovery
  • T1090.001 - Internal Proxy
MITREへのリンク →

Kimsuky

Score: 27.45
Matched TTPs:
  • T1059.007 - JavaScript
  • T1133 - External Remote Services
  • T1539 - Steal Web Session Cookie
  • T1098.007 - Additional Local or Domain Groups
  • T1589.003 - Employee Names
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1588.003 - Code Signing Certificates
  • T1102.001 - Dead Drop Resolver
  • T1078.003 - Local Accounts
MITREへのリンク →

Mustang Panda

Score: 9.66
Matched TTPs:
  • T1059.007 - JavaScript
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

TA578

Score: 3.99
Matched TTPs:
  • T1059.007 - JavaScript
  • T1583.006 - Web Services
MITREへのリンク →

Evilnum

Score: 5.01
Matched TTPs:
  • T1059.007 - JavaScript
  • T1539 - Steal Web Session Cookie
MITREへのリンク →

Star Blizzard

Score: 9.54
Matched TTPs:
  • T1059.007 - JavaScript
  • T1539 - Steal Web Session Cookie
  • T1550.004 - Web Session Cookie
MITREへのリンク →

TeamTNT

Score: 4.46
Matched TTPs:
  • T1133 - External Remote Services
  • T1102 - Web Service
MITREへのリンク →

FIN13

Score: 12.55
Matched TTPs:
  • T1133 - External Remote Services
  • T1098.007 - Additional Local or Domain Groups
  • T1556 - Modify Authentication Process
  • T1090.001 - Internal Proxy
MITREへのリンク →

Ember Bear

Score: 5.78
Matched TTPs:
  • T1133 - External Remote Services
  • T1021 - Remote Services
MITREへのリンク →

Sandworm Team

Score: 11.21
Matched TTPs:
  • T1133 - External Remote Services
  • T1539 - Steal Web Session Cookie
  • T1589.003 - Employee Names
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Volt Typhoon

Score: 11.08
Matched TTPs:
  • T1133 - External Remote Services
  • T1584.008 - Network Devices
  • T1124 - System Time Discovery
  • T1090.001 - Internal Proxy
MITREへのリンク →

Velvet Ant

Score: 7.53
Matched TTPs:
  • T1133 - External Remote Services
  • T1090.001 - Internal Proxy
  • T1078.003 - Local Accounts
MITREへのリンク →

Scattered Spider

Score: 13.23
Matched TTPs:
  • T1133 - External Remote Services
  • T1539 - Steal Web Session Cookie
  • T1204 - User Execution
  • T1578.002 - Create Cloud Instance
MITREへのリンク →

APT41

Score: 8.37
Matched TTPs:
  • T1133 - External Remote Services
  • T1098.007 - Additional Local or Domain Groups
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

LAPSUS$

Score: 10.20
Matched TTPs:
  • T1133 - External Remote Services
  • T1204 - User Execution
  • T1578.002 - Create Cloud Instance
MITREへのリンク →

OilRig

Score: 13.25
Matched TTPs:
  • T1133 - External Remote Services
  • T1137.004 - Outlook Home Page
  • T1555.004 - Windows Credential Manager
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

Wizard Spider

Score: 12.55
Matched TTPs:
  • T1133 - External Remote Services
  • T1021 - Remote Services
  • T1555.004 - Windows Credential Manager
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

APT29

Score: 14.37
Matched TTPs:
  • T1133 - External Remote Services
  • T1583.006 - Web Services
  • T1573 - Encrypted Channel
  • T1665 - Hide Infrastructure
  • T1078.003 - Local Accounts
MITREへのリンク →

Threat Group-3390

Score: 5.09
Matched TTPs:
  • T1133 - External Remote Services
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

Sea Turtle

Score: 4.60
Matched TTPs:
  • T1133 - External Remote Services
  • T1078.003 - Local Accounts
MITREへのリンク →

Chimera

Score: 4.53
Matched TTPs:
  • T1133 - External Remote Services
  • T1124 - System Time Discovery
MITREへのリンク →

Dragonfly

Score: 5.09
Matched TTPs:
  • T1133 - External Remote Services
  • T1098.007 - Additional Local or Domain Groups
MITREへのリンク →

APT28

Score: 14.51
Matched TTPs:
  • T1133 - External Remote Services
  • T1584.008 - Network Devices
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1669 - Wi-Fi Networks
MITREへのリンク →

Play

Score: 4.60
Matched TTPs:
  • T1133 - External Remote Services
  • T1078.003 - Local Accounts
MITREへのリンク →

Leviathan

Score: 9.69
Matched TTPs:
  • T1133 - External Remote Services
  • T1584.008 - Network Devices
  • T1102.003 - One-Way Communication
MITREへのリンク →

LuminousMoth

Score: 3.03
Matched TTPs:
  • T1539 - Steal Web Session Cookie
MITREへのリンク →

Lotus Blossom

Score: 5.96
Matched TTPs:
  • T1539 - Steal Web Session Cookie
  • T1090.001 - Internal Proxy
MITREへのリンク →

APT42

Score: 9.40
Matched TTPs:
  • T1539 - Steal Web Session Cookie
  • T1102 - Web Service
  • T1056 - Input Capture
MITREへのリンク →

ZIRCONIUM

Score: 14.76
Matched TTPs:
  • T1584.008 - Network Devices
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1665 - Hide Infrastructure
  • T1124 - System Time Discovery
MITREへのリンク →

APT3

Score: 3.15
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
MITREへのリンク →

Magic Hound

Score: 11.18
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1583.006 - Web Services
  • T1573 - Encrypted Channel
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

APT5

Score: 3.15
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
MITREへのリンク →

Aquatic Panda

Score: 3.84
Matched TTPs:
  • T1021 - Remote Services
MITREへのリンク →

Silent Librarian

Score: 3.84
Matched TTPs:
  • T1589.003 - Employee Names
MITREへのリンク →

Rocke

Score: 5.81
Matched TTPs:
  • T1102 - Web Service
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

FIN8

Score: 5.67
Matched TTPs:
  • T1102 - Web Service
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

Gamaredon Group

Score: 11.07
Matched TTPs:
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1102.003 - One-Way Communication
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

HAFNIUM

Score: 4.68
Matched TTPs:
  • T1583.006 - Web Services
  • T1078.003 - Local Accounts
MITREへのリンク →

Lazarus Group

Score: 9.93
Matched TTPs:
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1124 - System Time Discovery
  • T1090.001 - Internal Proxy
MITREへのリンク →

POLONIUM

Score: 4.41
Matched TTPs:
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

CURIUM

Score: 6.21
Matched TTPs:
  • T1584.006 - Web Services
  • T1124 - System Time Discovery
MITREへのリンク →

Tropic Trooper

Score: 6.29
Matched TTPs:
  • T1573 - Encrypted Channel
  • T1078.003 - Local Accounts
MITREへのリンク →

BITTER

Score: 3.62
Matched TTPs:
  • T1573 - Encrypted Channel
MITREへのリンク →

Storm-1811

Score: 3.84
Matched TTPs:
  • T1056 - Input Capture
MITREへのリンク →

APT39

Score: 9.17
Matched TTPs:
  • T1056 - Input Capture
  • T1102.002 - Bidirectional Communication
  • T1090.001 - Internal Proxy
MITREへのリンク →

Stealth Falcon

Score: 3.62
Matched TTPs:
  • T1555.004 - Windows Credential Manager
MITREへのリンク →

BlackTech

Score: 3.15
Matched TTPs:
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

BRONZE BUTLER

Score: 5.88
Matched TTPs:
  • T1124 - System Time Discovery
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

RTM

Score: 3.29
Matched TTPs:
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

Patchwork

Score: 3.29
Matched TTPs:
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.77
Matched TTPs:
  • T1102.001 - Dead Drop Resolver
  • T1098.007 - Additional Local or Domain Groups
  • T1102.002 - Bidirectional Communication
  • T1078.003 - Local Accounts
  • T1539 - Steal Web Session Cookie
  • T1059.007 - JavaScript
  • T1583.006 - Web Services
  • T1133 - External Remote Services
  • T1588.003 - Code Signing Certificates
  • T1589.003 - Employee Names
MITREへのリンク →

Turla

Score: 0.69
Matched TTPs:
  • T1090.001 - Internal Proxy
  • T1124 - System Time Discovery
  • T1102.002 - Bidirectional Communication
  • T1078.003 - Local Accounts
  • T1102 - Web Service
  • T1059.007 - JavaScript
  • T1555.004 - Windows Credential Manager
  • T1583.006 - Web Services
  • T1584.006 - Web Services
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る