Full Report
On 2024-06-05, a campaign was reported, involving an unknown actor, gaining initial access via 1-day vulnerability, while using Vulnerability exploitation, targeting ThinkPHP to achieve Resource hijacking. The following tools were observed: Dama.
Analysis Summary
# Tool/Technique: Dama
## Overview
Dama is identified as a webshell deployed by an unknown threat actor following a 1-day vulnerability exploitation targeting ThinkPHP applications, leading to resource hijacking.
## Technical Details
- Type: Tool (Webshell)
- Platform: Web Server/Applications (Targeting PHP applications, specifically ThinkPHP)
- Capabilities: Provides remote command execution and web shell functionality post-exploitation.
- First Seen: June 5, 2024 (in the context of this campaign report)
## MITRE ATT&CK Mapping
- [TA0002 - Execution]
- [T1059 - Command and Scripting Interpreter]
- [T1059.002 - Command and Scripting Interpreter: PowerShell] (Note: While Dama is likely PHP-based, this is a general category for interpreter abuse; specific execution via webshell maps closer to T1059)
- [TA0003 - Persistence]
- [T1505 - Server Software Compromise] (If Dama persists on the compromised server)
- [TA0010 - Impact]
- [T1486 - Data Encrypted for Impact] (If used for ransomware/extortion, though the report mentions Resource Hijacking)
## Functionality
### Core Capabilities
- **Webshell Functionality:** Allows the attacker to execute arbitrary commands on the compromised web server via HTTP requests.
- **Initial Foothold Maintenance:** Ensures continuous access after the initial vulnerability exploitation (Vulnerability Exploitation via 1-day vulnerability).
### Advanced Features
- Given the context of "Resource hijacking," Dama likely facilitates the compromise and utilization of the victim's server resources, potentially for cryptomining, hosting other malicious content, or launching further attacks.
## Indicators of Compromise
- File Hashes: [Not provided in context]
- File Names: Commonly deployed as a webshell file (specific name not provided, but generally uploaded to a web-accessible directory).
- Registry Keys: [N/A - Typically targets file system/web application structure]
- Network Indicators: [Not provided in context]
- Behavioral Indicators: Detection of obfuscated or unexpected file execution requests against web scripts, sudden high CPU/memory usage on the web server, or unusual outbound network connections originating from the web application process.
## Associated Threat Actors
- ❓Unknown
## Detection Methods
- **Signature-based detection:** Signatures targeting known Dama payloads or structures (if available).
- **Behavioral detection:** Monitoring web server logs for suspicious POST requests containing command execution patterns or known webshell function calls (e.g., `eval()`, `system()`, `shell_exec()` being triggered via the application endpoint).
- **YARA rules if available:** [Not provided in context]
## Mitigation Strategies
- **Prevention measures:** Immediately patch the 1-day vulnerability being exploited against ThinkPHP applications.
- **Hardening recommendations:** Implement a Web Application Firewall (WAF) configured to block common webshell command injection patterns. Restrict the execution permissions of the web server user account and ensure the application directory permissions limit writing capabilities.
## Related Tools/Techniques
- **Technique:** Vulnerability Exploitation (T1190)
- **Related Tool Class:** Other PHP Webshells (e.g., China Chopper, Weevely variants).