Security News > 2022 > May > New IceApple exploit toolset deployed on Microsoft Exchange servers
Security researchers have found a new post-exploitation framework that they dubbed IceApple, deployed mainly on Microsoft Exchange servers across a wide geography.
The researchers observed IceApple being deployed after the threat actor obtains initial access to the network belonging to organizations in various activity sectors: technology, academic, and government.
According to the researchers, IceApple has been deployed on Microsoft Exchange Server instances but it can also run under Internet Information Services web applications.
The threat actor behind IceApple has a solid grasp of the IIS software.
"Detailed analysis of the modules suggests that IceApple has been developed by an adversary with deep knowledge of the inner workings of IIS software" - CrowdStrike OverWatch.
A closer look reveals that the files have not been randomly created and they are loaded in a way that is not typical of Microsoft Exchange and IIS. Discovering IceApple was possible after CrowdStrike's Falcon cloud-based security solution triggered an alert at a new customer's Microsoft OWA deployment for.
News URL
Related news
- DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects (source)
- FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux (source)
- Microsoft fixes bug causing Windows Server 2025 boot errors (source)
- Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now (source)
- Microsoft isn't fixing 8-year-old shortcut exploit abused for spying (source)
- Microsoft Exchange Online outage affects Outlook web users (source)
- Microsoft: Exchange Online bug mistakenly quarantines user emails (source)
- Android Malware Exploits a Microsoft-Related Security Blind Spot to Avoid Detection (source)
- Hijacked Microsoft web domain injects spam into SharePoint servers (source)