CrowdStrike recently reported a critical zero-day vulnerability in a Linux-based Mitel VoIP appliance that served as the threat actor’s entry point to a ransomware victim’s network. The flaw, tracked as CVE-2022-29499, was identified and patched in April 2022, and is an incorrect data validation vulnerability within a Mitel MiVoice Connect appliance located on the network perimeter. If exploited, this vulnerability allows threat actors to conduct a novel remote code execution (RCE) attack to gain initial access to the network environment. After a preliminary investigation, CrowdStrike security researchers traced the malicious activity to a single internal IP address assigned to a Mitel MiVoice Connect VoIP appliance. The filesystem of the VoIP device indicated that the threat actors had leveraged anti-forensic techniques to attempt to hide their footprint from investigators by deleting the data from the drive. This proved ineffective however, as the investigators were able to recover the deleted data. The investigation indicated that the exploit was facilitated by two (2) HTTP GET requests for a specific server resource to fetch commands from the actor-controlled command and control (C2) infrastructure. The threat actors used the exploitation of this vulnerability to create an SSL-enabled reverse shell to launch a web shell on the targeted MiVoice appliance and download a proxy tool known as Chisel. The threat actors attempted to execute Chisel to use it as a reverse proxy for pivoting further into the target infrastructure; however, the victim organization’s security infrastructure was able to detect the compromise and prevented further lateral movement. At this time, neither the victim nor the threat actor has been publicly identified. CTIX analysts recommend any organizations using Mitel VoIP appliances ensure that they update their infrastructure to the latest stable firmware version available.