CampaignPublished 27 Jan 2021Updated 29 Aug 2026

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

Affects cert-ist enrichedSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

CERT-FR reports a campaign by the Sandworm intrusion set targeting Centreon systems primarily in Western Europe. The campaign exploits public-facing Linux applications to perform file discovery, deploy web shells, modify system processes, and exfiltrate data via command and control channels. Multiple threat actors including Iridium, Telebots, Sandworm, and Electrum are involved. The overall threat level is assessed as low by CERT-IST, with medium severity noted in the report. No patches are currently available for this threat.

Impact

The campaign enables threat actors to gain unauthorized access to Centreon Linux systems, perform system reconnaissance, maintain persistence via web shells and system process modifications, and exfiltrate sensitive data over encrypted channels. This can lead to data breaches, system compromise, and potential disruption of monitoring infrastructure. The involvement of multiple sophisticated threat actors increases the risk of targeted attacks in Western Europe.

Defensive guidance

No patches or official fixes are currently available for this threat. Organizations should monitor for indicators of compromise related to this campaign and apply compensating controls as recommended by CERT-FR and CERT-IST advisories. Follow vendor and CERT guidance for detection and response. Since the threat targets public-facing applications, reducing exposure and hardening these systems is advised. Check vendor advisories regularly for updates on remediation.

Indicators of compromise

Hashes 12

e1ff729f45b587a5ebbc8a8a97a7923fc4ada14de4973704c9b4b89c50fd1146
a739f44390037b3d0a3942cd43d161a7c45fd7e7
92ef0aaf5f622b1253e5763f11a08857
893750547255b848a273bd1668e128a5e169011e79a7f5c7bb86cc5d7b2153bc
c69db1b120d21bd603f13006d87e817fed016667
84837778682450cdca43d1397afd2310
928d8dde63b0255feffc3d03db30aa76f7ed8913238321cc101083c2c5056ffa
b7afb8c91f8f9df4f18764c25251576a0f8bef6f
a89251cd4c15909a8e15256ead40584e
ebe98d5e1ab6966ec1e292fafbd5ef21c2b15bd7c7bb871d8e756971b8b6877a

Comment 9

Backdoors related to Sandworm
These IOCs come from an ANSSI report (CERTFR-2021-CTI-004) published on February 15, 2021, which document a campaign of system compromises that impacted several French entities. This campaign targeted the Centreon IT monitoring software. The first compromises identified by the ANSSI date back from the end of 2017 and the attacks have continued until 2020. They mainly affected IT service providers, particularly web hosting providers. On the compromised systems, the webshell P.A.S. (alias Fobushell) is deployed in the Centreon web folder. Its content remains encrypted until the attacker connects to it and enters the right password. In several cases, this webshell has been used to deploy the Exaramel backdoor. This malware written in Go language is also deployed in the Centreon directory and its persistence is ensured via a scheduled task (Cron). The initial vector of this attack campaign is not precisely known. It can simply be assumed that it involves the exploitation of a vulnerability or a weakness in the Centreon monitoring software. The analyses allowed to identify two categories of infrastructure used in these attacks: Anonymization infrastructure: attackers use Tor or VPN services to connect to the webshells, Command and control infrastructure: Attackers use dedicated servers to manage the implants. Note: Exaramel communicates with its command and control servers via HTTPS. WARNING: the ANSSI does not attribute these attacks to the Sandworm group (alias Telebots) and therefore even less to a Russian intelligence unit. The similarities observed relate to the modus operandi implemented: in particular the Exaramel backdoor and infrastructure elements. In reality, these elements of similarity even seem rather weak, at least on the sole reading of the ANSSI report.Cert-IST Description
ExaramelCert-IST Malware Name
FobushellCert-IST Malware Name
PASCert-IST Malware Name
P.A.S.Cert-IST Malware Name
Sandworm TeamCert-IST Attack Alias
ELECTRUMCert-IST Attack Alias
BlackEnergyCert-IST Attack Alias

Text 1

Cert-IST Attack name

TeleBots

Link 1

Cert-IST External link

https://wws.cert-ist.com/private/fr/IocAttack_details?format=html&objectType=ATK&ref=CERT-IST/ATK-2016-066

File 7

/tmp/.applocktxSocket created by Exaramel
/tmp/.applockSocket created by Exaramel
configtx.jsonExaramel configuration file
centreon_module_linux_app64
search.php
DB-Drop.php
/bin/backup

Target location 1

Cert-IST Targeted Country

France

Datetime 2

2021-01-26T23:00:00+00:00Cert-IST First Disclosed Date
2017-10-31T23:00:00+00:00Cert-IST First Seen Date

Community reviews

Loading reviews…