The CERT-FR report details a cyber espionage campaign attributed to the Sandworm intrusion set, a well-known advanced persistent threat (APT) group linked to Russian state-sponsored activities. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions deployed primarily on Linux servers. The attack leverages exploitation of public-facing applications (MITRE ATT&CK T1190) to gain initial access, followed by deployment of web shells (T1505.003) to maintain persistence and facilitate remote command execution. The adversaries perform file and directory discovery (T1083) to map the environment and identify valuable data. They also employ deobfuscation and decoding techniques (T1140) to analyze and manipulate files or information, likely to evade detection and understand system configurations. Communication with command and control (C2) servers is conducted over encrypted channels (T1573), using symmetric and asymmetric cryptography (T1573.001 and T1573.002), ensuring stealthy exfiltration of data (T1041). The attackers create or modify system processes (T1543) and Windows services (T1543.003) to establish persistence and facilitate lateral movement. The campaign is confirmed to target Linux systems in Western Europe, with high confidence in the indicators of compromise (IOCs) provided. Although no specific affected versions or patches are noted, the campaign's medium severity rating reflects the moderate threat level posed by this targeted espionage activity. The involvement of multiple threat actors such as Iridium, Telebots, Electrum, and Sandworm indicates a coordinated and persistent effort to compromise Centreon deployments for intelligence gathering or sabotage purposes.

For European organizations, particularly those relying on Centreon for critical infrastructure monitoring, this campaign poses significant risks. Successful exploitation can lead to unauthorized access to sensitive operational data, disruption of monitoring capabilities, and potential manipulation or destruction of system logs and alerts. This undermines the ability to detect and respond to incidents promptly, increasing the risk of prolonged undetected intrusions. The exfiltration of data over encrypted channels compromises confidentiality, potentially exposing sensitive network and system information to adversaries. The modification of system processes and services can degrade system integrity and availability, impacting business continuity. Given Centreon's widespread use in sectors such as energy, telecommunications, and government within Western Europe, the campaign could affect critical national infrastructure and essential services. The stealthy nature of the attack, combined with the use of sophisticated cryptographic methods and web shells, complicates detection and remediation efforts, increasing the potential for long-term compromise and espionage.

European organizations should implement targeted mitigation strategies beyond generic best practices. First, conduct a comprehensive audit of all Centreon deployments, focusing on public-facing instances, to identify and remediate any vulnerabilities or misconfigurations. Employ strict network segmentation to isolate Centreon servers from other critical infrastructure components, limiting lateral movement opportunities. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying web shell activity and anomalous process creation/modification, particularly monitoring for unusual Windows service changes on hybrid environments. Utilize network traffic analysis tools to detect encrypted C2 communications, leveraging behavioral analytics to identify deviations from normal Centreon traffic patterns. Regularly update and harden Centreon installations, applying vendor patches promptly once available, and consider implementing application-layer firewalls or web application firewalls (WAFs) to block exploitation attempts against public-facing interfaces. Enhance logging and monitoring with a focus on file and directory access patterns, and integrate threat intelligence feeds to stay informed on emerging IOCs related to Sandworm and associated groups. Finally, conduct targeted user training for system administrators to recognize signs of compromise and enforce strict access controls and multi-factor authentication (MFA) for all administrative interfaces.