Historical Campaign Targeting Centreon IT Monitoring Software

Between 2017 and 2020, threat actors targeted entities using Centreon IT monitoring software, with a focus on web hosting providers and IT service organizations. The campaign involved unauthorized access to Centreon servers, leading to the deployment of the P.A.S. (Fobushell) webshell within the Centreon web directory. This webshell served as the primary entry point for manual interaction and follow-on malicious activity. In several identified cases, the actors deployed the Exaramel backdoor, a malware written in the Go programming language, to further strengthen their control over the compromised systems. Exaramel achieved persistence through scheduled cron tasks and communicated with external command-and-control (C2) infrastructure via HTTPS. The attackers utilized anonymization services, including Tor and commercial VPNs, to obfuscate their connection to the deployed webshells. While the report mentions similarities in TTPs to the Sandworm intrusion set, the French national cybersecurity agency (ANSSI) noted that these attributions remain inconclusive due to the limited nature of the shared operational elements.

Attack Chain

1. Initial exploitation of unknown vulnerabilities or weaknesses in the target Centreon installation.
2. Unauthorized file upload of the P.A.S. (Fobushell) webshell into the Centreon web directory.
3. Authentication to the webshell using a predefined password to execute arbitrary commands.
4. Deployment of the Exaramel backdoor (Go-based) into the Centreon directory.
5. Establishment of persistence for the Exaramel backdoor using a Linux Cron scheduled task.
6. Configuration of Exaramel via local files (e.g., configtx.json) and creation of temporary socket files in /tmp/ for communication.
7. Exfiltration or command execution via Exaramel communicating with C2 servers over HTTPS.
8. Use of Tor or VPN services by operators to obscure management of the webshell and C2 channels.

Impact

The campaign resulted in the compromise of several French entities, particularly IT service providers and web hosting firms. Successful exploitation allowed attackers to maintain persistent, long-term access to critical infrastructure monitoring systems, posing significant risks of data exfiltration, lateral movement within the provider's network, and potential disruption of monitoring services for downstream clients.

Recommendation

Prioritize the identification and removal of unauthorized files within the Centreon directory structure and monitor for suspicious scheduled tasks.

• Deploy file integrity monitoring (FIM) on the Centreon web directory to detect unauthorized additions of PHP or binary files.
• Audit existing cron jobs on all Centreon monitoring servers for unexpected execution paths.
• Implement network egress filtering to restrict unauthorized HTTPS traffic from monitoring servers to known Tor exit nodes or unapproved VPN endpoints.
• Scan the /tmp/ directory for artifacts associated with Exaramel, such as files named .applock or .applocktx.