Author: CyberDudeBivash
Powered by: CyberDudeBivash Brand | cyberdudebivash.com
Related:cyberbivash.blogspot.com

Published by CyberDudeBivash • Date: Oct 31, 2025 (IST)

Your MDM is a Backdoor: How Airstalk Malware Exploits VMware AirWatch for Covert Espionage

Airstalk is a new Windows malware family that abuses AirWatch/Workspace ONE UEM APIs—not a zero-day—to build a covert command channel and exfiltrate browser artifacts (cookies, history, bookmarks, screenshots). It primarily uses the Devices API and custom attributes as a C2 “dead drop,” with PowerShell and .NET variants observed in a likely supply-chain campaign. CyberDudeBivash Ecosystem:Apps & Services · Threat Intel (Blogger) · CryptoBivash · News Portal · Subscribe: ThreatWire

TL;DR — Treat MDM API Access as a Production Secret

What’s new: Airstalk misuses AirWatch’s legit APIs (e.g., /api/mdm/devices/, custom attributes, and file uploads) to hide C2/data exfil inside allowed MDM flows.
Impact: Theft of browser data (cookies, history, bookmarks) + screenshots; signed samples seen; multi-threaded C2.
Action now: Lock down UEM API credentials and network paths; enable strict mTLS/IP allowlists; alert on anomalous custom-attribute churn and device-file uploads; audit admin tokens; rotate all UEM API secrets.

How Airstalk Turns MDM into Covert C2

Key technique: Use AirWatch Devices API and custom device attributes as a covert message bus (“dead-drop”), periodically reading/writing values that carry operator tasks, beacons, or exfil payload references. Some samples also use file-upload features. Variants exist in PowerShell and .NET, with versioning and even a stolen certificate observed on some binaries.

Why it works: Enterprises often allow UEM APIs through firewalls and proxies; UEM traffic is “trusted IT,” so alarms are rare. Airstalk piggybacks on this trust boundary to move quietly.

Detections & Hunts (SOC/UEM/Proxy/EDR)

UEM Platform (AirWatch/Workspace ONE UEM)

Attribute churn: Alert when a device’s custom attributes change too frequently or carry suspicious base64/hex blobs.
Unusual API clients: Identify API calls to /api/mdm/devices/ and file-upload endpoints from non-UEM subnets/ASNs or off-hours service accounts.
Token hygiene: Find stale/never-rotated API tokens; enumerate all “integration” accounts with device-write scopes.

Proxy/Gateway

# Concept: highlight suspicious AirWatch API usage
zgrep -Ei " /api/mdm/devices/|/api/.*(file|upload|attributes)" access.log* \
| awk '{print $1,$4,$7,$9,$11}' | sort | uniq -c | sort -nr | head

Endpoint/EDR

PowerShell/.NET beacons: Rapid script block logging spikes; powershell.exe or rundll32/regsvr32 contacting UEM endpoints.
Browser data access: Processes touching Chrome/Edge/Brave profile DBs (Cookies, History) shortly before outbound UEM API calls. Airstalk’s goal set includes browser data and screenshots.

IOC Enrichment

Correlate Unit 42’s indicators/behavioral notes for Airstalk (cluster CL-STA-1009) with your logs; add “dead-drop via custom attributes” as a behavioral analytic.

Hardening & Response (AirWatch/UEM)

Network controls: Put UEM APIs behind private ingress + mTLS; allowlist only your MDM connectors and admin jumpboxes. Deny direct internet access to admin/API paths.
Credential governance: Rotate all UEM API keys/secrets; split duties (read vs write); enforce short-lived tokens and audit scopes quarterly.
Least-priv device writes: Disable or strictly limit custom attributes and device file-upload from integration accounts. Create per-app accounts with minimal scope.
Anomaly policies: Alert on high-frequency attribute edits; block attributes containing binary/base64-like payloads.
Segregate MDM egress: Route MDM management traffic through a dedicated proxy with DPI; log request bodies/size anomalies for API calls.
IR playbook: If suspicious usage is detected, revoke tokens, rotate credentials, quarantine affected devices, dump attribute history, and preserve proxy/UEM logs for timeline.

Note: Airstalk abuses legitimate APIs (no vendor 0-day required). Harden configuration and watch for behavioral indicators.

Related UEM Risk (Historical CVEs)

While Airstalk doesn’t need a new CVE, UEM platforms have had serious issues before. Examples include:

CVE-2022-22954 — Workspace ONE Access/Identity Manager SSTI → RCE (heavily exploited).
CVE-2021-22054 — Workspace ONE UEM pre-auth SSRF by Assetnote (internal cloud access risk).
CVE-2024-22260 — UEM information exposure (NVD).

Takeaway: Treat MDM as Tier-0—lock APIs like crown-jewel infra.

FAQ

Is this an AirWatch vulnerability?

No. Current reporting shows API abuse, not a new product flaw. Attackers ride on allowed MDM traffic and permissions.

What data does Airstalk target?

Browser artifacts (cookies, history, bookmarks) and screenshots; variants in PowerShell and .NET use multi-threaded C2 with versioning; some samples were code-signed.

Any evidence of supply-chain use?

Yes—Unit 42 assesses with medium confidence that Airstalk was used in a likely supply-chain attack and tracks it under cluster CL-STA-1009.

Can I just block the API?

Blocking breaks device management. Instead: privilege-separate accounts, enforce mTLS/IP allowlists, monitor attribute/file endpoints, and rotate tokens frequently.

Sources

Palo Alto Networks Unit 42 — New Windows-Based Malware Family “Airstalk” (API abuse via /api/mdm/devices/, custom attributes & file uploads; data theft goals).
SecurityOnline / CyberPress — Summaries confirming AirWatch API dead-drop C2 and suspected nation-state use.
Rapid7 — Historical mass exploitation of Workspace ONE Access (CVE-2022-22954, SSTI→RCE).
Assetnote & PortSwigger — Workspace ONE UEM pre-auth SSRF (CVE-2021-22054) research & impact.
NVD — CVE-2024-22260 (Workspace ONE UEM information exposure).

CyberDudeBivash — Services, Apps & Ecosystem

MDM/UEM Threat Hunts (AirWatch/Workspace ONE telemetry, API abuse analytics)
Zero-Trust UEM Hardening (mTLS, IP allowlists, least-priv API design, token rotation)
Supply-Chain Attack Response (forensic timeline, credential resets, containment)

Apps & Products · Consulting & Services · ThreatWire Newsletter · CyberBivash (Threat Intel) · News Portal · CryptoBivash

Edureka: Enterprise Mobility & Zero-Trust Kaspersky: Endpoint/MDM Protection AliExpress WW Alibaba WW

Ecosystem: cyberdudebivash.com | cyberbivash.blogspot.com | cryptobivash.code.blog | cyberdudebivash-news.blogspot.com | ThreatWire

#CyberDudeBivash #CyberBivash #Airstalk #AirWatch #WorkspaceONE #UEM #MDM #SupplyChain #C2 #ThreatWire

Cyberdudebivash