# BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)

> Kaspersky ICS CERT reports that the BO Team (Black Owl) APT compromised the infrastructure of a commercial software developer serving mainly Eastern European industrial enterprises. Entry was via an internet-exposed Linux terminal server, followed by Log4Shell (CVE-2021-44228) exploitation of VMware vCenter 7.0.3 and takeover of domain controllers, GitLab, Ansible, backup and code-signing servers, apparently to stage a downstream supply chain attack that was stopped before completion.

- **Published:** 2026-11-07T02:58:12Z
- **Last reviewed:** 2026-11-07T02:58:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5474
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5474.png
- **ID:** TL-2026-5474
- **Severity:** HIGH (CVSS 10)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** BO Team (Ukraine)
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)
- **CVEs:** CVE-2021-44228

## Description

In June 2025 a software developer whose products are used predominantly by industrial enterprises in Eastern Europe detected suspicious SMB connection attempts from system administrator computers and engaged incident response. Kaspersky ICS CERT's investigation (published 2026-11-05 after the victim completed remediation) found the intruders had been present for months and attributed the activity to BO Team (also tracked as Black Owl, Lifting Zmiy and Hoody Hyena) based on overlap with prior campaigns: pseudo-randomly named but otherwise identical obfuscated scripts, Nanodump followed by LOLBin-based LSASS dumping, timestomping, malware masquerading as legitimate software, malware stored under C:\Users\<user>\AppData\Local\Programs, Russian-language phishing, connections from a Lviv (Ukraine) provider, and an interest in compromising software vendors.

Initial access was through an internet-exposed Linux terminal server with SSH password authentication enabled (the hunt rationale and report describe SSH brute force against root/service accounts). From there the actor performed internal reconnaissance (Metasploit port scanning, nmap, Burp Suite through an SSH proxy, vulners.com and vendor documentation lookups), then exploited CVE-2021-44228 in the Apache Tomcat/log4j component of VMware vCenter 7.0.3 to obtain a reverse shell (Base64-encoded 'nc -e /bin/sh' command) on the hypervisors. Root SSH keys were stolen from the hypervisors, virtual network interfaces were created to reach VMs directly from the VPN subnet, and VMs were searched for secrets. A service-account password stored in a publicly readable LDAP comment field and a forgotten local administrator account helped reach the domain controllers; the actor dumped lsass.exe (Nanodump was blocked by the security product, so rundll32.exe with comsvcs.dll MiniDump ordinal 24 was used), extracted NTDS.dit with ntdsutil.exe, dumped registry hives, and generated Golden Tickets from the krbtgt keys. GitLab, an Ansible orchestration server (via stolen private keys), backup, SIEM, VPN, mail and code-signing servers were also compromised, and a modified /usr/bin/nxnode-login acted as a keylogger writing to /dev/shm/pulse-shm-3088612174.

Persistence on Linux relied on cron.hourly shell backdoors masquerading as PostgreSQL (pgcache) and VMware components (1vmware-timesync, vmware-toolbox-setdate), timestomped to 2021. They resolve attacker-controlled hostnames on the free nofrillsdns.com service; DNS records default to 127.0.0.1 while the C&C is inactive and were later pointed to 95.81.115.77. Payloads included a customized ReverseSSH build (process name 'exe') delivered in an AES-256-CBC archive executed from /proc/self/fd/3, and Global Socket (gsocket) for remote shell access. Defense evasion included Windows event log deletion, 'unset HISTFILE', Base64-encoded commands, invalid-character script obfuscation, and LOLBins (ie4uinit.exe, unregmp2.exe, fsquirt.exe, tasklist.exe, findstr.exe, taskmgr.exe, ipconfig.exe).

After the intrusion was detected, in late July 2025 the actor used the stolen mail-server DKIM private key to send a phishing email (subject 'Account disconnected from the mail server') that carried a valid DKIM signature and passed SPF, with an automatically generated phishing page overlaid on the official website, relayed via ip-223-6.dataclub.info (DataClub, Latvia). Days later DNS records were changed to activate the backdoors on test systems. The report concludes the actor was preparing to abuse the build and code-signing pipeline to compromise the developer's customers; this was not completed. Kaspersky's report lists 47 recommendations, including disabling SSH root login and password authentication, MFA, changing krbtgt twice, storing no plaintext credentials, backup isolation, network segmentation, EDR/SIEM deployment and 30+ days of log retention. Note: the report states no CVSS for the incident; the CVSS values below belong to CVE-2021-44228 and the HIGH severity is the analyst's judgment. Public reporting (The Record, 2025-06-02) describes BO Team as an independent pro-Ukraine group active since early 2024; BeaconBeagle was unreachable (HTTP 502) during research, so no C2 correlation was obtained.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1566.002 Spearphishing Link
- T1110.001 Password Guessing
- T1003.001 LSASS Memory
- T1003.003 NTDS
- T1056.001 Keylogging
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1558.001 Golden Ticket
- T1046 Network Service Discovery
- T1053.003 Cron
- T1070.006 Timestomp
- T1685.005 Clear Windows Event Logs
- T1070.003 Clear Command History
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1218.011 Rundll32
- T1021.004 SSH
- T1021.001 Remote Desktop Protocol
- T1059.004 Unix Shell
- T1568 Dynamic Resolution
- T1071.001 Web Protocols
- T1572 Protocol Tunneling

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BO Team Windows Credential Dumping - comsvcs MiniDump, ntdsutil, Hive Save and Log Clearing (TL-2026-5474)** (`TL-2026-5474-SPL-002`)

Detects LSASS dumping via rundll32.exe comsvcs.dll MiniDump (including ordinal 24 forms like #+0000^24), ntdsutil IFM extraction of NTDS.dit, registry hive saves, Nanodump references and wevtutil log clearing. BO Team used comsvcs after Nanodump was blocked, then extracted NTDS.dit and cleared event logs to forge Golden Tickets in TL-2026-5474.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.001, T1003.003, T1218.011, T1070.001
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
((Image="*\\rundll32.exe" CommandLine="*comsvcs*" (CommandLine="*MiniDump*" OR CommandLine="*#24*" OR CommandLine="*^24*"))
 OR (Image="*\\ntdsutil.exe" CommandLine="*ntds*" (CommandLine="*ifm*" OR CommandLine="*create full*"))
 OR (Image="*\\wevtutil.exe" (CommandLine="* cl *" OR CommandLine="*clear-log*"))
 OR (Image="*\\reg.exe" CommandLine="* save *" (CommandLine="*HKLM\\SAM*" OR CommandLine="*HKLM\\SYSTEM*" OR CommandLine="*HKLM\\SECURITY*"))
 OR CommandLine="*nanodump*")
| eval technique=case(match(Image,"(?i)rundll32"),"T1003.001 LSASS dump via comsvcs MiniDump", match(Image,"(?i)ntdsutil"),"T1003.003 NTDS.dit extraction", match(Image,"(?i)wevtutil"),"T1070.001 Windows event log cleared", match(Image,"(?i)reg[.]exe"),"Registry hive save (SAM/SYSTEM/SECURITY)", true(),"Nanodump or related LSASS tool")
| stats count min(_time) as first_seen values(CommandLine) as commands values(ParentImage) as parents by host, User, technique
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "rundll32.exe" and ProcessCommandLine has "comsvcs" and ProcessCommandLine matches regex @"(?i)(minidump|#[+0-9]*\^?24\b|\^24\b)")
    or (FileName =~ "ntdsutil.exe" and ProcessCommandLine has "ntds" and ProcessCommandLine has_any ("ifm", "create full"))
    or (FileName =~ "wevtutil.exe" and ProcessCommandLine matches regex @"(?i)(\s(cl|clear-log)\s)")
    or (FileName =~ "reg.exe" and ProcessCommandLine contains " save " and ProcessCommandLine matches regex @"(?i)hklm\\(sam|system|security)")
    or ProcessCommandLine contains "nanodump"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Windows Credential Dumping Via Comsvcs Ntdsutil Hive Save Or Log Clearing
id: 3e9d4c3b-9c3d-5f86-8d71-6c5cae4a2d04
status: experimental
description: Detects credential theft tradecraft BO Team used in TL-2026-5474 including rundll32 comsvcs MiniDump, ntdsutil IFM, registry hive export and event log clearing.
references:
    - https://ics-cert.kaspersky.com/publications/reports/2026/11/05/supply-chain-attack-bo-team-in-a-software-developers-infrastructure/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1003.003
    - attack.defense-evasion
    - attack.t1218.011
    - attack.t1070.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_rundll:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: 'comsvcs'
    selection_ordinal:
        CommandLine|contains:
            - 'MiniDump'
            - '#24'
            - '^24'
    selection_ntds:
        Image|endswith: '\ntdsutil.exe'
        CommandLine|contains|all:
            - 'ntds'
            - 'ifm'
    selection_wevtutil:
        Image|endswith: '\wevtutil.exe'
        CommandLine|contains:
            - ' cl '
            - 'clear-log'
    selection_hive:
        Image|endswith: '\reg.exe'
        CommandLine|contains|all:
            - ' save '
            - 'HKLM\'
        CommandLine|contains:
            - '\SAM'
            - '\SYSTEM'
            - '\SECURITY'
    selection_tool:
        CommandLine|contains: 'nanodump'
    condition: (selection_rundll and selection_ordinal) or selection_ntds or selection_wevtutil or selection_hive or selection_tool
falsepositives:
    - Backup and DR tooling that uses ntdsutil IFM or exports registry hives
    - Administrators clearing logs during maintenance
level: high

```

**Known false positives:**

- Authorized ntdsutil IFM snapshots for AD backup or migration
- Scheduled log maintenance that runs wevtutil cl
- Incident-response or EDR tooling that creates LSASS minidumps

**Tuning notes:** Allow-list backup service accounts and DC maintenance windows for ntdsutil and wevtutil. The comsvcs MiniDump branch has very low false positives and can be set to page. Ensure Sysmon process-creation logging with full command lines on domain controllers and admin workstations; Sysmon config must retain command line text.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BO Team SSH Password Brute Force Followed by Successful Login (TL-2026-5474) (locked: unlock with TL Creds)
- BO Team Linux Cron Backdoors, Masqueraded Binaries and Keylogger Harvest File (TL-2026-5474) (locked: unlock with TL Creds)
- BO Team Backdoor Network Callbacks - C2 IP, nofrillsdns Hosts and ReverseSSH Process 'exe' (TL-2026-5474) (locked: unlock with TL Creds)
- Java Process Spawning Shell With Base64 or Netcat Payload - Log4Shell Reverse Shell (TL-2026-5474) (locked: unlock with TL Creds)
- Rundll32 Writing LSASS Dump Artifact To Windows Temp (TL-2026-5474) (locked: unlock with TL Creds)
- Global Socket, ReverseSSH Loader and VMware Timesync Backdoor Command Lines (TL-2026-5474) (locked: unlock with TL Creds)
- BO Team Log4Shell (CVE-2021-44228) JNDI Injection Against VMware vCenter - TL-2026-5474 (locked: unlock with TL Creds)
- BO Team Dynamic DNS C2 nofrillsdns.com and C2 IP [indicator] (TL-2026-5474) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `95.81.115[.]77`
- Domain: `lo1yaizaeghaevarooD1ahtaichootae[.]nofrillsdns[.]com`
- File hash: `346b04985ec6c5d107ba0ddf32fe7691`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Kaspersky ICS CERT: Supply chain attack: BO Team in a software developer's infrastructure](https://ics-cert.kaspersky.com/publications/reports/2026/11/05/supply-chain-attack-bo-team-in-a-software-developers-infrastructure/)
- [NVD: CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2021-44228)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [VMware Security Advisory VMSA-2021-0028 (Log4Shell)](https://www.vmware.com/security/advisories/VMSA-2021-0028.html)
- [Apache Log4j security vulnerabilities](https://logging.apache.org/log4j/2.x/security.html)
- [The Record: Pro-Ukraine hacker group Black Owl a major threat to Russia](https://therecord.media/pro-ukraine-hacker-group-black-owl-major-threat-russia)
- [Anti-Malware.ru: BO Team shifted focus to industry and the oil and gas sector of Russia](https://www.anti-malware.ru/news/2026-05-06-111332/49950)
- [Kaspersky ICS CERT: APT and financial attacks on industrial organizations in Q2 2026](https://ics-cert.kaspersky.com/publications/apt-and-financial-attacks-on-industrial-organizations-in-q2-2026/)
- [NHAS/reverse_ssh (ReverseSSH source repository)](https://github.com/NHAS/reverse_ssh)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5474