Malicious IIS Extensions Gaining Popularity Among Cyber Criminals for Persistent Access

guest · Jul 27, 2022

July 27, 2022

Threat actors are increasingly abusing Internet Information Services (IIS) extensions to backdoor servers as a means of establishing a "durable persistence mechanism."

That's according to a new warning from the Microsoft 365 Defender Research Team, which said that "IIS backdoors are also harder to detect since they mostly reside in the same directories as legitimate modules used by target applications, and they follow the same code structure as clean modules."
Click to expand...

Indeed, earlier this month, Kaspersky researchers disclosed a campaign undertaken by the Gelsemium group, which was found taking advantage of the ProxyLogon Exchange Server flaws to launch a piece of IIS malware called SessionManager.

In another set of attacks observed by the tech giant between January and May 2022, Exchange servers were targeted with web shells by means of an exploit for the ProxyShell flaws, which ultimately led to the deployment of a backdoor called "FinanceSvcModel.dll" but not before a period of reconnaissance.

"The backdoor had built-in capability to perform Exchange management operations, such as enumerating installed mailbox accounts and exporting mailboxes for exfiltration," security researcher Hardik Suri explained.
Click to expand...

Microsoft: Malicious IIS extensions quietly open persistent backdoors into servers

Attackers are increasingly leveraging Internet Information Services (IIS) extensions as covert backdoors into servers, which hide deep in target environments and provide a durable persistence mechanism for attackers. While prior research has been published on specific incidents and variants, little is generally known about how attackers leverage the IIS platform as a backdoor.

Malicious IIS extensions are less frequently encountered in attacks against servers, with attackers often only using script web shells as the first stage payload. This leads to a relatively lower detection rate for malicious IIS extensions compared to script web shells.
Click to expand...

Log in or Sign up

Malicious IIS Extensions Gaining Popularity Among Cyber Criminals for Persistent Access

guest Guest

Log in or Sign up

Malicious IIS Extensions Gaining Popularity Among Cyber Criminals for Persistent Access

guest Guest

Useful Searches