Foresttiger

ForestTiger is a software vulnerability that has been exploited by threat actors, specifically Diamond Fleet, to compromise system security. The flaw in the software design or implementation has enabled the group to execute malicious activities, primarily through PowerShell scripts to download two payloads from seemingly legitimate infrastructure that they had previously compromised. The exploitation of this vulnerability has been methodically planned and executed, demonstrating the advanced capabilities of the threat actor. The attackers have particularly used ForestTiger Backdoor as one of their main tools for exploiting the identified vulnerability. They have been observed compromising TeamCity servers to deploy this persistent backdoor, named after the vulnerability itself. The ForestTiger Backdoor has been used to run scheduled tasks on the compromised systems, further deepening the extent of the breach and enabling the attackers to maintain a steady grip on the infiltrated systems. One of the key malicious activities facilitated by the ForestTiger Backdoor is the dumping of LSASS (Local Security Authority Subsystem Service) credentials from memory. This operation allows the attacker to gain access to sensitive user authentication information, thereby posing a significant threat to data security. The use of ForestTiger vulnerability and its associated backdoor underscores the need for robust cybersecurity measures to protect against such sophisticated threats.