Security News > 2021 > December > Hackers Using Malicious IIS Server Module to Steal Microsoft Exchange Credentials
Malicious actors are deploying a previously undiscovered binary, an Internet Information Services webserver module dubbed "Owowa," on Microsoft Exchange Outlook Web Access servers with the goal of stealing credentials and enabling remote command execution.
"Owowa is a C#-developed.NET v4.0 assembly that is intended to be loaded as a module within an IIS web server that also exposes Exchange's Outlook Web Access," Kaspersky researchers Paul Rascagneres and Pierre Delcher said.
In August 2021, Slovak cybersecurity company ESET's study of the IIS landscape revealed as many as 14 malware families that were developed as native IIS modules in an attempt to intercept HTTP traffic and remotely commandeer the compromised computers.
As a persistent component on the compromised system, Owawa is engineered to capture the credentials of users who are successfully authenticated on the OWA authentication web page.
The Russian security firm said it detected a cluster of targets with compromised servers located in Malaysia, Mongolia, Indonesia, and the Philippines that primarily belong to government organizations, with the exception of one server that's attached to a government-owned transportation company.
"The malicious module  represents an effective option for attackers to gain a strong foothold in targeted networks by persisting inside an Exchange server."
- Hackers Hijack Email Reply Chains on Unpatched Exchange Servers to Spread Malware (source)
- Microsoft asks bug hunters to probe on-premises Exchange, SharePoint servers (source)
- Microsoft Exchange servers hacked to deploy Hive ransomware (source)
- New IceApple exploit toolset deployed on Microsoft Exchange servers (source)
- Hackers Deploy IceApple Exploitation Framework on Hacked MS Exchange Servers (source)
- Microsoft Exchange targeted for IcedID reply-chain hijacking attacks (source)
- IcedID malware, in the hijacked email thread, with the insecure Exchange servers (source)
- IceID trojan delivered via hijacked email threads, compromised MS Exchange servers (source)
- Exchange Servers Speared in IcedID Phishing Campaign (source)
- Calendly actively abused in Microsoft credentials phishing (source)