Security News > 2022 > May > New IceApple exploit toolset deployed on Microsoft Exchange servers
Security researchers have found a new post-exploitation framework that they dubbed IceApple, deployed mainly on Microsoft Exchange servers across a wide geography.
The researchers observed IceApple being deployed after the threat actor obtains initial access to the network belonging to organizations in various activity sectors: technology, academic, and government.
According to the researchers, IceApple has been deployed on Microsoft Exchange Server instances but it can also run under Internet Information Services web applications.
The threat actor behind IceApple has a solid grasp of the IIS software.
"Detailed analysis of the modules suggests that IceApple has been developed by an adversary with deep knowledge of the inner workings of IIS software" - CrowdStrike OverWatch.
A closer look reveals that the files have not been randomly created and they are loaded in a way that is not typical of Microsoft Exchange and IIS. Discovering IceApple was possible after CrowdStrike's Falcon cloud-based security solution triggered an alert at a new customer's Microsoft OWA deployment for.
News URL
Related news
- Microsoft 365 outage impacts Exchange Online, Teams, Sharepoint (source)
- Hackers exploit ProjectSend flaw to backdoor exposed servers (source)
- Microsoft re-releases Exchange updates after fixing mail delivery (source)
- Russia-Linked Turla Exploits Pakistani Hackers' Servers to Target Afghan and Indian Entities (source)
- Attackers Exploit Microsoft Teams and AnyDesk to Deploy DarkGate Malware (source)