Netwrix Auditor RCE Flaw

A newly found Truebot Malware targets both US and Canada-based organizations to exfiltrate sensitive information by exploiting vulnerabilities in the Netwrix Auditor application(CVE-2022-31199).

Truebot malware is a botnet that is delivered through phishing campaigns to attack victims, now exploiting the vulnerability to gain access to the machine.

CISA and FBI jointly issue warnings about the increased activity of this new malware variant.

Truebot Malware Attack:

Increased activity of truebot has been observed since May 31, 2023, and it is presumed to be used by CL0P Ransomware Gang.

The delivery of the payload is achieved either through phishing attempts or through exploiting the vulnerability.

The payload has been concealed as a legitimate software update notification and was delivered through emails to trick the users into executing.

Once the user executes the email, it redirects to a malicious domain, and script files will be executed to collect the information.


Netwrix Auditor is software used for on-premises and cloud-based IT system auditing. Attackers utilize the remote code execution vulnerability (CVE-2022-31199) in this software for lateral movement.

It employs various tools and techniques to achieve persistence; initially, it loads Flawed Grace, a remote access tool to store payloads and inject additional payloads on scheduled tasks to establish the connection to the C2 server.

Later it uploads Cobalt Strike beacons into memory in dormant mode for further operations.

Through POST requests, it establishes bilateral communication with the C2 server, which downloads additional payloads and self-replicates across the environment.

The best practice to mitigate this attack is to patch the vulnerability and update the applications and software used. And apply controls to prevent remote execution attempts.

Indicator of Compromise:

MD5 HashF33734DFBBFF29F68BCDE052E523C287
MD5 HashF176BA63B4D68E576B5BA345BEC2C7B7
MD5 HashF14F2862EE2DF5D0F63A88B60C8EEE56
MD5 Hash6164e9d297d29aa8682971259da06848

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.

Sujatha is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under her belt in Cyber Security, she is covering Cyber Security News, technology and other news.


Please enter your comment!
Please enter your name here