Security News > 2023 > February > Hackers backdoor Microsoft IIS servers with new Frebniis malware
Hackers are deploying a new malware named 'Frebniss' on Microsoft's Internet Information Services that stealthily executes commands sent via web requests.
Microsoft IIS is a web server software that acts as a web server and a web app hosting platform for services like Outlook on the Web for Microsoft Exchange.
In the attacks seen by Symantec, the hackers abuse an IIS feature called 'Failed Request Event Buffering', responsible for collecting request metadata.
The malware injects malicious code into a specific function of a DLL file that controls FREB to enable the attacker to intercept and monitor all HTTP POST requests sent to the ISS server.
Advanced network traffic monitoring tools might also help detect unusual activity from malware like Frebniis.
In October 2022, Symantec discovered another malware used by the Cranefly hacking group that abused ISS logs to send and receive commands from the C2 server without raising any alarms.
News URL
Related news
- Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers (source)
- DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects (source)
- North Korean Hackers Deploy FERRET Malware via Fake Job Interviews on macOS (source)
- Hackers spoof Microsoft ADFS login pages to steal credentials (source)
- New Microsoft script updates Windows media with bootkit malware fixes (source)
- Hackers exploit SimpleHelp RMM flaws to deploy Sliver malware (source)
- Microsoft says attackers use exposed ASP.NET keys to deploy malware (source)
- Attackers compromise IIS servers by leveraging exposed ASP.NET machine keys (source)
- FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux (source)
- North Korean hackers spotted using ClickFix tactic to deliver malware (source)