APT actors exploit Proself online storage flaws
IPA warns that nation-state APT actors are exploiting authentication bypass and OS command injection vulnerabilities in Proself online storage software.
Japan's IPA (Information-technology Promotion Agency) issued an alert reiterating concerns about network-penetrating attacks targeting internet-facing online storage products. The advisory highlights active exploitation of two vulnerabilities in the Proself product: an administrator authentication bypass (CVE-2023-39415) and an OS command injection flaw (CVE-2023-39416). IPA notes some of this activity has been linked to nation-state-backed APT operations, and separately references new disclosures regarding exploitation of an XML External Entity (XXE) vulnerability in the same product line.
IPA draws a parallel to prior incidents involving FileZen and MOVEit, where vulnerabilities in file-transfer/online-storage products were leveraged as initial access points for data-theft campaigns suspected to involve APT actors. The agency urges organizations using online storage solutions to coordinate with vendors and system integrators on patching, and to assess supply-chain exposure since some products may be OEM variants of software with disclosed vulnerabilities. IPA is soliciting incident reports from Japanese organizations affected by unauthorized access to support broader threat awareness and mitigation efforts.
The advisory does not name specific threat actor groups but frames the activity as part of an ongoing pattern of nation-state interest in exploiting internet-exposed file transfer and storage infrastructure, consistent with broader industry observations around MOVEit and similar platforms in 2023.
Mentioned in this report
Detection guidance
Web Application Process Spawning Command Interpreter (Possible OS Command Injection)
Detects IIS/Java web server worker processes spawning cmd.exe or powershell.exe, consistent with OS command injection exploitation such as CVE-2023-39416 in Proself. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Application Process Spawning Command Interpreter
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \\w3wp.exe
- \\java.exe
- \\javaw.exe
- \\tomcat9.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
filter:
CommandLine|contains:
- C:\\Program Files\\Common Files\\
condition: selection and not filter
falsepositives:
- Legitimate web application administrative scripts that intentionally shell out to
system utilities
- Scheduled maintenance tasks configured to run under the IIS application pool identity
level: high
tags:
- attack.t1190
- attack.initial_access
id: 005d6182-2509-55e4-affa-281eebbeb60b
status: experimental
author: Vorant
Post-Exploitation Reconnaissance Commands from Web Server Process
Detects common reconnaissance commands (whoami, net, systeminfo, ipconfig) executed as children of a web server worker process, indicating possible successful exploitation of an internet-facing storage/file-transfer application such as Proself. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon Commands Executed by IIS or Java Web Process
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \\w3wp.exe
- \\java.exe
- \\javaw.exe
- \\tomcat9.exe
selection_cmd:
Image|endswith:
- \\whoami.exe
- \\net.exe
- \\net1.exe
- \\systeminfo.exe
- \\ipconfig.exe
- \\tasklist.exe
condition: selection_parent and selection_cmd
falsepositives:
- Health-check or monitoring scripts invoked by application servers that call system
utilities for diagnostics
level: medium
tags:
- attack.t1190
- attack.discovery
id: 57a691ec-b694-5cee-8695-528dbd1cbfe5
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20231019.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free