Rocket Kitten is the name reported for Iranian-connected threat actors who distributed Core Impact malware through CVE-2022-22954, a remote code execution flaw in VMware Workspace ONE Access and Identity Manager. This post explains the flaw, how the backdoor is deployed and which update to apply.
What did the Rocket Kitten campaign do?
It has been detected that the Iranian-connected Rocket Kitten threat actors have recently distributed “Core Impact” malware through an updated VMware RCE security vulnerability.
How does the VMware RCE flaw work?
The vulnerability monitored by code CVE-2022-22954 and affecting VMware Workspace ONE Access and Identity Manager solutions cause RCE attacks that allow a threat actor with network access, and no authentication, to run code remotely. Threat actors who use this vulnerability to access the target system then deploy the Core Impact Backdoor to memory using the PowerShell script called PowerTrash.
How can you protect against it?
The widespread use of VMware Identity Manager solutions and unlimited remote access to threat actors from this attack can lead to destructive breaches among industries.
In this context, it is recommended that users using vulnerable VMware products immediately apply the published updates to protect against attacks that can be carried out using the said vulnerability. In addition, it is important to prevent the IoC findings related to the campaign in question from the security solutions used.