Security News > 2021 > August > New APT Hacking Group Targets Microsoft IIS Servers with ASP.NET Exploits

A new highly capable and persistent threat actor has been targeting major high-profile public and private entities in the U.S. as part of a series of targeted cyber intrusion attacks by exploiting internet-facing Microsoft Internet Information Services servers to infiltrate their networks.

"TG1021 uses a custom-made malware framework, built around a common core, tailor-made for IIS servers. The toolset is completely volatile, reflectively loaded into an affected machine's memory and leaves little-to-no trace on infected targets," the researchers said.

"The threat actor also uses an additional stealthy backdoor and several post-exploitations modules to perform network reconnaissance, elevate privileges, and move laterally within networks."

Besides exhibiting capabilities that show a significant effort to avoid detection by actively interfering with logging mechanisms and successfully evading commercial endpoint detection and response systems, the threat actor has been known to leverage an arsenal of ASP.NET web application exploits to gain an initial foothold and backdoor the servers by executing a sophisticated implant named "NodeIISWeb" that's designed to load custom DLLs as well as intercept and handle HTTP requests received by the server.

Interestingly, Sygnia's investigation into TG1021's tactics, techniques, and procedures have unearthed "Major overlaps" to those of a nation-sponsored actor named "Copy-Paste Compromises," as detailed in an advisory released by the Australian Cyber Security Centre in June 2020, which described a cyber campaign targeting public-facing infrastructure primarily through the use of unpatched flaws in Telerik UI and IIS servers.

"Continuous forensics activities and timely incident response are essential to identifying and effectively defending networks from attacks by similar threat actors."

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/ESsa1FdAlIU/new-apt-hacking-group-targets-microsoft.html