According to Mandiant , a hacking group known as UNC1945 was using a zero-day vulnerability in the Oracle Solaris operating system to carry out attacks on corporate networks.
UNC1945 typically targeted targets in the telecommunications, financial and consulting sectors, Mandiant said in a report .
While the UNC1945 group has been active since 2018, Mandiant says it caught its attention earlier this year when it began exploiting a new zero day in Oracle Solaris.
Known as CVE-2020-14871, the zero-day was discovered in the Solaris Pluggable Authentication Module (PAM) that allowed UNC1945 to bypass authentication processes and install a backdoor named SLAPSTICK on Solaris servers exposed to the Internet.
The hacking group then used this backdoor as an entry point to launch reconnaissance operations within corporate networks and move laterally to other systems.
To evade detection, the team downloaded and installed a QEMU running a version of the Tiny Core Linux OS.
This custom Linux VM comes pre-installed with various hacking such as network scanners, password crackers, and recognition tools, which allowed UNC1945 to scan a company's internal network for vulnerabilities and move laterally across multiple systems, regardless of whether they were running Windows or *NIX-based systems.
Mandiant said it reported the zero day to Oracle earlier this year after discovering signs of exploitation during an investigation.
The bug was fixed last month with Oracle's October 2020 security updates.
Mandiant said that while UNC1945 has been active for several years, it detected the Solaris zero day when a confirmed breach. However, that doesn't mean the zero day vulnerability hasn't been exploited on other corporate networks.
