GLASSTOKEN

In observed attacks, threat actors exploited the vulnerabilities to gain initial access into victim organizations. | CVE-2023-46805 (CVSS: 8.2) – Authentication Bypass in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure... If exploited together, these vulnerabilities would allow a remote and unauthenticated threat actor to craft malicious requests and execute arbitrary commands on the system. | CVE-2024-21887 (CVSS: 9.1) – Command Injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure... If exploited together, these vulnerabilities would allow a remote and unauthenticated threat actor to craft malicious requests and execute arbitrary commands on the system.

Webshells, tracked under the name GLASSTOKEN, were then deployed to enable command execution and long-term persistence in victim environments.

Threat actors leverage code execution from request parameters that are decoded from hex to base64 decoded, then passed to Assembly.Load(). Which is used to execute arbitrary powershell commands.

“Cyber actors will exploit software vulnerabilities such as command-injection and achieve unauthenticated remote code execution (RCE).”

Exploitation in real world attacks resulted in the deployment of the GLASSTOKEN webshells to enable long-term persistence and command execution.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.