Skip to main content
Microsoft Security

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations

April 2023 update – Microsoft Threat Intelligence has shifted to a new threat actor naming taxonomy aligned around the theme of weather. MERCURY is now tracked as Mango Sandstorm.

To learn about how the new taxonomy represents the origin, unique traits, and impact of threat actors, and to get a complete mapping of threat actor names, read this blog: Microsoft shifts to a new threat actor naming taxonomy.

In recent weeks, the Microsoft Threat Intelligence Center (MSTIC) and Microsoft 365 Defender Research Team detected Iran-based threat actor MERCURY leveraging exploitation of Log4j 2 vulnerabilities in SysAid applications against organizations all located in Israel. MSTIC assesses with high confidence that MERCURY’s observed activity was affiliated with Iran’s Ministry of Intelligence and Security (MOIS).

While MERCURY has used Log4j 2 exploits in the past, such as on vulnerable VMware apps, we have not seen this actor using SysAid apps as a vector for initial access until now. After gaining access, MERCURY establishes persistence, dumps credentials, and moves laterally within the targeted organization using both custom and well-known hacking tools, as well as built-in operating system tools for its hands-on-keyboard attack.

This blog details Microsoft’s analysis of observed MERCURY activity and related tools used in targeted attacks. This information is shared with our customers and industry partners to improve detection of these attacks, such as implementing detections against MERCURY’s tools in both Microsoft Defender Antivirus and Microsoft Defender for Endpoint. As with any observed nation-state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information needed to secure their accounts.

MERCURY TTPs align with Iran-based nation-state actor

Microsoft assesses with moderate confidence that MERCURY exploited remote code execution vulnerabilities in Apache Log4j 2 (also referred to as “Log4Shell”) in vulnerable SysAid Server instances the targets were running. MERCURY has used Log4j 2 exploits in past campaigns as well. 

MSTIC assesses with high confidence that MERCURY is coordinating its operations in affiliation with Iran’s Ministry of Intelligence and Security (MOIS). According to the US Cyber Command, MuddyWater, a group we track as MERCURY, “is a subordinate element within the Iranian Ministry of Intelligence and Security.”

The following are common MERCURY techniques and tooling:

This latest activity sheds light on behavior MERCURY isn’t widely known for: scanning and exploiting a vulnerable application on a target’s device. They have been observed performing this activity in the past, but it is not very common. The exploits are derived from open source and sculpted to fit their needs. 

Observed actor activity

Initial access

On July 23 and 25, 2022, MERCURY was observed using exploits against vulnerable SysAid Server instances as its initial access vector. Based on observations from past campaigns and vulnerabilities found in target environments, Microsoft assess that the exploits used were most likely related to Log4j 2. The threat actor leveraged Log4j 2 exploits against VMware applications earlier in 2022 and likely looked for similarly vulnerable internet-facing apps. SysAid, which provides IT management tools, might have presented as an attractive target for its presence in the targeted country.

MERCURY attack chain throughout the initial access, execution, discovery, persistence, credential theft, lateral movement, and communications stages.
Figure 1. Observed MERCURY attack chain

Exploiting SysAid successfully enables the threat actor to drop and leverage web shells to execute several commands, as listed below. Most commands are related to reconnaissance, with one encoded PowerShell that downloads the actor’s tool for lateral movement and persistence.

Executed commands:

Persistence

Once MERCURY has obtained access to the target organization, the threat actor establishes persistence using several methods, including:

The actor leverages the new local administrator user to connect through remote desktop protocol (RDP). During this session, the threat actor dumps credentials by leveraging the open-source application Mimikatz. We also observed MERCURY later performing additional credential dumping in SQL servers to steal other high privileged accounts, like service accounts.

Lateral movement

We observed MERCURY further using its foothold to compromise other devices within the target organizations by leveraging several methods, such as:

Most of the commands launched are meant to install tools on targets or perform reconnaissance to find domain administrator accounts.

Communication

Throughout the attack, the threat actor used different methods to communicate with their command-and-control (C2) server, including:

Microsoft will continue to monitor MERCURY activity and implement protections for our customers. The current detections, advanced detections, and IOCs in place across our security products are detailed below. 

Recommended customer actions

The techniques used by the actor and described in the Observed actor activity section can be mitigated by adopting the security considerations provided below: 

Indicators of compromise (IOCs)

The below list provides IOCs observed during our investigation. We encourage our customers to investigate these indicators in their environments and implement detections and protections to identify past related activity and prevent future attacks against their systems.

IndicatorTypeDescription
hxxp://sygateway[.]comDomainFirst seen: May 16, 2022
91[.]121[.]240[.]104IP addressFirst seen: May 17, 2022
164[.]132[.]237[.]64IP addressFirst seen: November 26, 2021
 e81a8f8ad804c4d83869d7806a303ff04f31cce376c5df8aada2e9db2c1eeb98SHA-256mimikatz.exe
416e937fb467b7092b9f038c1f1ea5ca831dd19ed478cca444a656b5d9440bb4SHA-256vpnui.exe Ligolo
25325dc4b8dcf3711e628d08854e97c49cfb904c08f6129ed1d432c6bfff576bSHA-256VBScript
3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71SHA-256Remcom
3137413d086b188cd25ad5c6906fbb396554f36b41d5cff5a2176c28dd29fb0aSHA-256Web shell
87f317bbba0f50d033543e6ebab31665a74c206780798cef277781dfdd4c3f2fSHA-256Web shell
e4ca146095414dbe44d9ba2d702fd30d27214af5a0378351109d5f91bb69cdb6SHA-256Web shell
d2e2a0033157ff02d3668ef5cc56cb68c5540b97a359818c67bd3e37691b38c6SHA-256Web shell
3ca1778cd4c215f0f3bcfdd91186da116495f2d9c30ec22078eb4061ae4b5b1bSHA-256Web shell
bbfee9ef90814bf41e499d9608647a29d7451183e7fe25f472c56db9133f7e40SHA-256Web shell
b8206d45050df5f886afefa25f384bd517d5869ca37e08eba3500cda03bddfefSHA-256Web shell

NOTE: These indicators should not be considered exhaustive for this observed activity.

Microsoft Defender Threat Intelligence

Community members and customers can find summary information and all IOCs from this blog post in the linked Microsoft Defender Threat Intelligence portal article.

Detections

Microsoft Defender Antivirus

Microsoft Defender Antivirus detects attempted exploitation and post-exploitation activity and payloads. Turn on cloud-delivered protection to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block most new and unknown threats. Refer to the list of detection names related to exploitation of Log4j 2 vulnerabilities. Detections for the IOCs listed above are listed below:

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint customers should monitor the alert “Mercury Actor activity detected” for possible presence of the indicators of compromise listed above.

Reducing the attack surface

Microsoft Defender for Endpoint customers can turn on the following attack surface reduction rule to block or audit some observed activity associated with this threat:

Detecting Log4j 2 exploitation

Alerts that indicate threat activity related to the exploitation of the Log4j 2 exploitation should be immediately investigated and remediated. Refer to the list of Microsoft Defender for Endpoint alerts that can indicate exploitation and exploitation attempts.

Detecting post-exploitation activity

Alerts with the following titles may indicate post-exploitation threat activity related to MERCURY activity described in this blog and should be immediately investigated and remediated. These alerts are supported on both Windows and Linux platforms:

Any alert title related to web shell threats, for example:

Any alert title that mentions PowerShell, for example:

Any alert title related to suspicious remote activity, for example:

Any alert related to persistence, for example:

Any alert title that mentions credential dumping activity or tools, for example:

Microsoft Defender Vulnerability Management

Microsoft 365 Defender customers can use threat and vulnerability management to identify and remediate devices that are vulnerable to Log4j 2 exploitation. A more comprehensive guidance on this capability can be found on this blog: Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability.

Advanced hunting queries

Microsoft Sentinel

Microsoft Sentinel customers can use the following queries to look for the related malicious activity in their environments.

Identify MERCURY IOCs

The query below identifies matches based on IOCs shared in this post for the MERCURY actor across a range of common Microsoft Sentinel data sets:

Identify SysAid Server web shell creation

The query below looks for potential web shell creation by SysAid Server:

Identify MERCURY PowerShell commands

The query below identifies instances of PowerShell commands used by the threat actor in command line data:

 In addition to the above, Microsoft Sentinel users should also look for possible Log4j 2 vulnerabilities, the details of which were shared in a previous blog post.

Microsoft 365 Defender

To locate related activity, Microsoft 365 Defender customers can run the following advanced hunting queries:

Potential WebShell creation by SysAisServer instance

DeviceFileEvents
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe") 
| where InitiatingProcessCommandLine has "SysAidServer" 
| where FileName endswith ".jsp"

Abnormal process out of SysAidServer instance

DeviceProcessEvents
| where Timestamp > ago(7d) 
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe") 
| where InitiatingProcessCommandLine has "SysAidServer" 
| summarize makeset(ProcessCommandLine), min(Timestamp), max(Timestamp) by DeviceId

PowerShell commands used by MERCURY

DeviceProcessEvents
| where FileName =~ "powershell.exe" and ProcessCommandLine has_cs "-exec bypass -w 1 -enc" 
| where ProcessCommandLine contains_cs "UwB0AGEAcgB0AC0ASgBvAGIAIAAtAFMAYwByAGkAcAB0AEIAbABvAGMAawAgAHsAKABzAGEAcABzACAAKAAiAHAA" 
| summarize makeset(ProcessCommandLine), makeset(InitiatingProcessCommandLine, 10), makeset(DeviceId), min(Timestamp), max(Timestamp) by DeviceId

Vulnerable Log4j 2 devices

Use this query to identify vulnerabilities in installed software on devices, surface file-level findings from the disk, and provide the ability to correlate them with additional context in advanced hunting.

DeviceTvmSoftwareVulnerabilities 
| where CveId in ("CVE-2021-44228", "CVE-2021-45046")

DeviceTvmSoftwareEvidenceBeta
| mv-expand DiskPaths
| where DiskPaths contains "log4j"
| project DeviceId, SoftwareName, SoftwareVendor, SoftwareVersion, DiskPaths