UPDATE to June 24, 2022 FLASH UPDATE: Artic Wolf Labs researchers have recently published a report detailing, with medium confidence, that the Lorenz ransomware group has begun utilizing a critical Mitel MiVoice Voice-over-IP (VOIP) vulnerability to gain initial access into victims’ phone systems and later breach their networks. The vulnerability, tracked as CVE-2022-29499, is a remote code execution (RCE) flaw that impacts the Mitel Service Application component of MiVoice Connect and was patched in April 2022. The Lorenz group, first observed in February of 2021, has recently been targeting small to medium-sized businesses located across the United States as well as in Mexico and China. Researchers observed recent activity in which Lorenz exploited this flaw to obtain a reverse shell in combination with using the Chisel tunneling tool to gain access into the victim environment. Once initial access was established, the threat group did not proceed with further activity for approximately one (1) month. After this time period, the threat actor utilized the post-exploitation tool “CrackMapExec” for credential access purposes as well as “certutil”, “ipconfig”, and “findstr” for network and domain enumeration purposes. Finally, Lorenz discovered credentials for two (2) privileged administrator accounts that allowed the group to move laterally throughout the victim environment and conduct exfiltration and encryption activity. What is notable about Lorenz exploiting this specific vulnerability is that “no public proof-of-concept (PoC) exploit code for this vulnerability has ever been released” as well as the fact that “there is very little known about which threat actors possess the exploit.” Adrian Korn, the manager of threat intelligence research at Artic Worf Labs, provided two (2) possibilities for this exploitation. The first possibility is that “there is an Initial Access Broker (IAB) that has exclusive access to the exploit for CVE-2022-29499”. The second possibility is that “the actors behind Lorenz have exclusive access to an exploit for CVE-2022-29499.” Mitel VOIP products are used by governments and organizations within critical industries globally and administrators must ensure that their products remain up to date. A further in-depth analysis of the Lorenz activity as well as indicators of compromise (IOCs) can be viewed in Artic Wolf’s report linked below.