BfV Cyber-Brief Nr. 01/2022

BfV warns of an ongoing APT27 cyberespionage campaign (since March 2021) targeting German companies by exploiting Microsoft Exchange and Zoho ADSelfService Plus vulnerabilities to deploy the HYPERBRO RAT; the report provides detailed technical analysis of HYPERBRO's components, installation/execution flow, persistence techniques, C2 behavior, indicators of compromise (IP addresses, file paths, mutexes, named pipe, registry keys) and YARA detection rules, and recommends scanning logs and networks (including historical logs since Feb 2021) using the supplied IOCs and rules.