Skip to navigation

Threat reportSupply ChainTL-2026-5474

BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)

highACTIVE

Kaspersky ICS CERT reports that the BO Team (Black Owl) APT compromised the infrastructure of a commercial software developer serving mainly Eastern European industrial enterprises. Entry was via an internet-exposed Linux terminal server, followed by Log4Shell (CVE-2021-44228) exploitation of VMware vCenter 7.0.3 and takeover of domain controllers, GitLab, Ansible, backup and code-signing servers, apparently to stage a downstream supply chain attack that was stopped before completion.

Key facts for BO Team supply chain attack

IdentifiersTL-2026-5474, CVE-2021-44228
Also known asBO Team supply chain attack on a software developer
SeverityHIGH
CVSS10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
First disclosed
Exploitation statusExploited in the wild; Listed in CISA KEV: CVE-2021-44228 (added )
EPSSCVE-2021-44228: 99.9% (99.9th percentile)
Affected productsVMware vCenter Server; Apache Log4j2
Weaknesses (CWE)CWE-20, CWE-400, CWE-502, CWE-917
AttributionBO Team (medium confidence)
Nation-state nexusUkraine
MalwareBackdoor.Shell.Agent.t
ToolsGlobal Socket, Nanodump, ReverseSSH, metasploit
MITRE ATT&CK techniquesT1003.001 LSASS Memory, T1003.003 NTDS, T1021.001 Remote Desktop Protocol, T1021.004 SSH, T1027 Obfuscated Files or Information, T1036.005 Match Legitimate Resource Name or Location, T1046 Network Service Discovery, T1053.003 Cron, T1056.001 Keylogging, T1059.004 Unix Shell, T1070.003 Clear Command History, T1070.006 Timestomp and 12 more in the attack flow
MotivationHACKTIVISM
Target sectorssoftware development, industrial automation, industrial enterprises, manufacturing
Target regions151 - Eastern Europe, russia
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for BO Team supply chain attack

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5474 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BO Team Windows Credential Dumping - comsvcs MiniDump, ntdsutil, Hive Save and Log Clearing (TL-2026-5474)

Detects LSASS dumping via rundll32.exe comsvcs.dll MiniDump (including ordinal 24 forms like #+0000^24), ntdsutil IFM extraction of NTDS.dit, registry hive saves, Nanodump references and wevtutil log clearing. BO Team used comsvcs after Nanodump was blocked, then extracted NTDS.dit and cleared event logs to forge Golden Tickets in TL-2026-5474.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1003.001, T1003.003, T1218.011, T1070.001
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
((Image="*\\rundll32.exe" CommandLine="*comsvcs*" (CommandLine="*MiniDump*" OR CommandLine="*#24*" OR CommandLine="*^24*"))
 OR (Image="*\\ntdsutil.exe" CommandLine="*ntds*" (CommandLine="*ifm*" OR CommandLine="*create full*"))
 OR (Image="*\\wevtutil.exe" (CommandLine="* cl *" OR CommandLine="*clear-log*"))
 OR (Image="*\\reg.exe" CommandLine="* save *" (CommandLine="*HKLM\\SAM*" OR CommandLine="*HKLM\\SYSTEM*" OR CommandLine="*HKLM\\SECURITY*"))
 OR CommandLine="*nanodump*")
| eval technique=case(match(Image,"(?i)rundll32"),"T1003.001 LSASS dump via comsvcs MiniDump", match(Image,"(?i)ntdsutil"),"T1003.003 NTDS.dit extraction", match(Image,"(?i)wevtutil"),"T1070.001 Windows event log cleared", match(Image,"(?i)reg[.]exe"),"Registry hive save (SAM/SYSTEM/SECURITY)", true(),"Nanodump or related LSASS tool")
| stats count min(_time) as first_seen values(CommandLine) as commands values(ParentImage) as parents by host, User, technique

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "rundll32.exe" and ProcessCommandLine has "comsvcs" and ProcessCommandLine matches regex @"(?i)(minidump|#[+0-9]*\^?24\b|\^24\b)")
    or (FileName =~ "ntdsutil.exe" and ProcessCommandLine has "ntds" and ProcessCommandLine has_any ("ifm", "create full"))
    or (FileName =~ "wevtutil.exe" and ProcessCommandLine matches regex @"(?i)(\s(cl|clear-log)\s)")
    or (FileName =~ "reg.exe" and ProcessCommandLine contains " save " and ProcessCommandLine matches regex @"(?i)hklm\\(sam|system|security)")
    or ProcessCommandLine contains "nanodump"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: Windows Credential Dumping Via Comsvcs Ntdsutil Hive Save Or Log Clearing
id: 3e9d4c3b-9c3d-5f86-8d71-6c5cae4a2d04
status: experimental
description: Detects credential theft tradecraft BO Team used in TL-2026-5474 including rundll32 comsvcs MiniDump, ntdsutil IFM, registry hive export and event log clearing.
references:
    - https://ics-cert.kaspersky.com/publications/reports/2026/11/05/supply-chain-attack-bo-team-in-a-software-developers-infrastructure/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1003.003
    - attack.defense-evasion
    - attack.t1218.011
    - attack.t1070.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_rundll:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: 'comsvcs'
    selection_ordinal:
        CommandLine|contains:
            - 'MiniDump'
            - '#24'
            - '^24'
    selection_ntds:
        Image|endswith: '\ntdsutil.exe'
        CommandLine|contains|all:
            - 'ntds'
            - 'ifm'
    selection_wevtutil:
        Image|endswith: '\wevtutil.exe'
        CommandLine|contains:
            - ' cl '
            - 'clear-log'
    selection_hive:
        Image|endswith: '\reg.exe'
        CommandLine|contains|all:
            - ' save '
            - 'HKLM\'
        CommandLine|contains:
            - '\SAM'
            - '\SYSTEM'
            - '\SECURITY'
    selection_tool:
        CommandLine|contains: 'nanodump'
    condition: (selection_rundll and selection_ordinal) or selection_ntds or selection_wevtutil or selection_hive or selection_tool
falsepositives:
    - Backup and DR tooling that uses ntdsutil IFM or exports registry hives
    - Administrators clearing logs during maintenance
level: high

Known false positives:

  • Authorized ntdsutil IFM snapshots for AD backup or migration
  • Scheduled log maintenance that runs wevtutil cl
  • Incident-response or EDR tooling that creates LSASS minidumps

Tuning notes: Allow-list backup service accounts and DC maintenance windows for ntdsutil and wevtutil. The comsvcs MiniDump branch has very low false positives and can be set to page. Ensure Sysmon process-creation logging with full command lines on domain controllers and admin workstations; Sysmon config must retain command line text.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • BO Team SSH Password Brute Force Followed by Successful Login (TL-2026-5474) · unlock with TL Creds
  • BO Team Linux Cron Backdoors, Masqueraded Binaries and Keylogger Harvest File (TL-2026-5474) · unlock with TL Creds
  • BO Team Backdoor Network Callbacks - C2 IP, nofrillsdns Hosts and ReverseSSH Process 'exe' (TL-2026-5474) · unlock with TL Creds
  • Java Process Spawning Shell With Base64 or Netcat Payload - Log4Shell Reverse Shell (TL-2026-5474) · unlock with TL Creds
  • Rundll32 Writing LSASS Dump Artifact To Windows Temp (TL-2026-5474) · unlock with TL Creds
  • Global Socket, ReverseSSH Loader and VMware Timesync Backdoor Command Lines (TL-2026-5474) · unlock with TL Creds
  • BO Team Log4Shell (CVE-2021-44228) JNDI Injection Against VMware vCenter - TL-2026-5474 · unlock with TL Creds
  • BO Team Dynamic DNS C2 nofrillsdns.com and C2 IP [indicator] (TL-2026-5474) · unlock with TL Creds

Indicators of compromise for BO Team supply chain attack

As of 2026-11-07, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5474.

Sample indicators (3 of 25)

  • IP address: 95.81.115[.]77
  • Domain: lo1yaizaeghaevarooD1ahtaichootae[.]nofrillsdns[.]com
  • File hash: 346b04985ec6c5d107ba0ddf32fe7691

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

25 indicators of compromise · unlock with TL Creds. Compare plans

How BO Team supply chain attack works

In June 2025 a software developer whose products are used predominantly by industrial enterprises in Eastern Europe detected suspicious SMB connection attempts from system administrator computers and engaged incident response. Kaspersky ICS CERT's investigation (published 2026-11-05 after the victim completed remediation) found the intruders had been present for months and attributed the activity to BO Team (also tracked as Black Owl, Lifting Zmiy and Hoody Hyena) based on overlap with prior campaigns: pseudo-randomly named but otherwise identical obfuscated scripts, Nanodump followed by LOLBin-based LSASS dumping, timestomping, malware masquerading as legitimate software, malware stored under C:\Users\<user>\AppData\Local\Programs, Russian-language phishing, connections from a Lviv (Ukraine) provider, and an interest in compromising software vendors.

Initial access was through an internet-exposed Linux terminal server with SSH password authentication enabled (the hunt rationale and report describe SSH brute force against root/service accounts). From there the actor performed internal reconnaissance (Metasploit port scanning, nmap, Burp Suite through an SSH proxy, vulners.com and vendor documentation lookups), then exploited CVE-2021-44228 in the Apache Tomcat/log4j component of VMware vCenter 7.0.3 to obtain a reverse shell (Base64-encoded 'nc -e /bin/sh' command) on the hypervisors. Root SSH keys were stolen from the hypervisors, virtual network interfaces were created to reach VMs directly from the VPN subnet, and VMs were searched for secrets. A service-account password stored in a publicly readable LDAP comment field and a forgotten local administrator account helped reach the domain controllers; the actor dumped lsass.exe (Nanodump was blocked by the security product, so rundll32.exe with comsvcs.dll MiniDump ordinal 24 was used), extracted NTDS.dit with ntdsutil.exe, dumped registry hives, and generated Golden Tickets from the krbtgt keys. GitLab, an Ansible orchestration server (via stolen private keys), backup, SIEM, VPN, mail and code-signing servers were also compromised, and a modified /usr/bin/nxnode-login acted as a keylogger writing to /dev/shm/pulse-shm-3088612174.

Persistence on Linux relied on cron.hourly shell backdoors masquerading as PostgreSQL (pgcache) and VMware components (1vmware-timesync, vmware-toolbox-setdate), timestomped to 2021. They resolve attacker-controlled hostnames on the free nofrillsdns.com service; DNS records default to 127.0.0.1 while the C&C is inactive and were later pointed to 95.81.115.77. Payloads included a customized ReverseSSH build (process name 'exe') delivered in an AES-256-CBC archive executed from /proc/self/fd/3, and Global Socket (gsocket) for remote shell access. Defense evasion included Windows event log deletion, 'unset HISTFILE', Base64-encoded commands, invalid-character script obfuscation, and LOLBins (ie4uinit.exe, unregmp2.exe, fsquirt.exe, tasklist.exe, findstr.exe, taskmgr.exe, ipconfig.exe).

After the intrusion was detected, in late July 2025 the actor used the stolen mail-server DKIM private key to send a phishing email (subject 'Account disconnected from the mail server') that carried a valid DKIM signature and passed SPF, with an automatically generated phishing page overlaid on the official website, relayed via ip-223-6.dataclub.info (DataClub, Latvia). Days later DNS records were changed to activate the backdoors on test systems. The report concludes the actor was preparing to abuse the build and code-signing pipeline to compromise the developer's customers; this was not completed. Kaspersky's report lists 47 recommendations, including disabling SSH root login and password authentication, MFA, changing krbtgt twice, storing no plaintext credentials, backup isolation, network segmentation, EDR/SIEM deployment and 30+ days of log retention. Note: the report states no CVSS for the incident; the CVSS values below belong to CVE-2021-44228 and the HIGH severity is the analyst's judgment. Public reporting (The Record, 2025-06-02) describes BO Team as an independent pro-Ukraine group active since early 2024; BeaconBeagle was unreachable (HTTP 502) during research, so no C2 correlation was obtained.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1003.003 NTDS; T1056.001 Keylogging; T1110.001 Password Guessing; T1552.001 Credentials In Files; T1552.004 Private Keys; T1558.001 Golden Ticket

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.004 SSH

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History; T1070.006 Timestomp; T1218.011 Rundll32

Discovery

T1046 Network Service Discovery

Persistence

T1053.003 Cron

Execution

T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1568 Dynamic Resolution; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

defense-impairment

T1685.005 Clear Windows Event Logs

Remediation for BO Team supply chain attack

Patches

  • Update Apache Log4j2 (fixed in 2.3.1, 2.12.2, 2.12.3 and later per NVD) and apply the VMware vCenter Server fixes for Log4Shell

Immediate actions

  • Block and hunt for the IOCs in this record: 95.81.115.77, nofrillsdns.com subdomains, and the listed MD5 hashes
  • Check /etc/cron.hourly for pgcache and 1vmware-timesync, and /usr/bin/vmware-toolbox-setdate, on ESXi/vCenter hosts and Linux VMs
  • Disable SSH root login and password authentication on internet-exposed hosts
  • Reset krbtgt twice and rotate domain, service-account, SSH, GitLab, Ansible and DKIM keys if compromise is suspected
  • Remove plaintext credentials from scripts and LDAP attribute/comment fields; audit local administrator groups for forgotten accounts

Workarounds

  • Remove vulnerable vCenter/log4j assets from reachable networks until patched
  • Restrict outbound connections from hypervisors and management hosts

Longer-term hardening

  • Enforce MFA on critical systems and restrict RDP/SSH/SCP/SMB with ACLs
  • Segment networks (VLANs, allow-list policies) and isolate management, security and backup infrastructure
  • Deploy EDR, SIEM correlation rules and network traffic anomaly monitoring; retain event logs for at least 30 days
  • Store backups on non-domain servers with integrity verification and restore tests
  • Enforce SPF/DKIM/DMARC, protect mail-server DKIM keys, and harden the CI/CD and code-signing pipeline

Affected and fixed versions

  • VMware — vCenter Server
    Vulnerable versions: 7.0.3
  • Apache — Log4j2
    Vulnerable versions: 2.0-beta9 through 2.15.0
    Fixed in: 2.3.1; 2.12.2; 2.12.3

Timeline of BO Team supply chain attack

  • CVE-2021-44228 (Log4Shell, CVSS 10.0) published and added to the CISA KEV catalog
  • BO Team (Black Owl) first appears via a Telegram channel in early 2024 (exact day not stated in sources)
  • June 2025 (day not stated): the victim software developer detects suspicious SMB connection attempts from system administrator computers and starts incident response
  • The Record publishes Kaspersky-sourced reporting on BO Team/Black Owl as a pro-Ukraine group targeting Russian organizations
  • Date approximate (report says 'day 1 of incident response'): responders identify BO Team malware traces and commands, including the SSH-exposed Linux terminal server entry point, Log4Shell exploitation of vCenter 7.0.3, and compromise of domain controllers, GitLab, Ansible and code-signing servers (exact dates not stated; earlier undetected activity spanned months)
  • Late July 2025 (day approximate): after detection, the actor sends a phishing email signed with the stolen DKIM key that passes SPF, with an automatically generated phishing page
  • Days after the phishing attempt (date approximate): DNS records are updated to locked-ioc-21 to activate backdoors on test systems and multi-stage scripts are delivered
  • Anti-Malware.ru reports Kaspersky findings that BO Team shifted focus to industrial and oil and gas sectors in Russia
  • Kaspersky ICS CERT publishes the full report on the BO Team supply chain attack after the victim completed remediation

Sources cited for BO Team supply chain attack

Other reports on CVE-2021-44228

Further reading

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats