1/9 The French National Cybersecurity Agency @ANSSI_FR released a report on Hades / Sandworm infecting Centreon servers with a PHP backdoor, followed by deploying the Exaramel Linux backdoor. Some notes:

2/9 Centreon is an IT monitoring software, created by a French company with the same name. Some customers include Accor Hotels, AirFrance / KLM, Airbus, Euronews, Orange and various French gov agencies. No indication any of these were breached.

3/9 The first compromise took place in 2017 and and the campaign lasted until 2020. Campaign mostly affected information technology providers, especially web hosting providers. Important: the initial compromise method is not known.

4/9 The attackers rely heavily on the P.A.S. webshell. This would commonly be deployed in the Centreon web server folder, eg "/usr/local/centreon/www/search.php" and created by the apache user. In addition to the webshell, attackers also deployed the Exaramel backdoor.

5/9 Exaramel is a multiplatform backdoor; Windows and Linux versions are known to exist. The Linux version is written in Golang. It was first reported by ESET in 2018. On infected systems, @ANSSI_FR found it was created by the apache user, same as the P.A.S. webshell.

6/9 Hades / Sandworm is the only known group that uses Exaramel. Exaramel has code similarities with the Industroyer main backdoor. The report does not include other public links to Hades / Sandworm.

7/9 To manage the backdoors, the attackers used TOR and several VPN services: PRIVATEINTERNETACCESS, EXPRESSVPN and VPNBOOK. They also used some undisclosed IPs that do not appear to be associated with known VPNs or TOR.

8/9 Although the @ANSSI_FR report makes it clear the infection vector is unknown, the details suggest the attackers were more likely exploiting a vulnerability in the Centreon software rather than a supply chain attack. This vulnerability may have been closed in 2020.

9/9 As usual, simple things, such as monitoring for new PHP files and executable, running Yara rules for known malware or antivirus software should catch these attacks.
Report and IOCs: https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-005/