Security News > 2023 > February > Hackers backdoor Microsoft IIS servers with new Frebniis malware
Hackers are deploying a new malware named 'Frebniss' on Microsoft's Internet Information Services that stealthily executes commands sent via web requests.
Microsoft IIS is a web server software that acts as a web server and a web app hosting platform for services like Outlook on the Web for Microsoft Exchange.
In the attacks seen by Symantec, the hackers abuse an IIS feature called 'Failed Request Event Buffering', responsible for collecting request metadata.
The malware injects malicious code into a specific function of a DLL file that controls FREB to enable the attacker to intercept and monitor all HTTP POST requests sent to the ISS server.
Advanced network traffic monitoring tools might also help detect unusual activity from malware like Frebniis.
In October 2022, Symantec discovered another malware used by the Cranefly hacking group that abused ISS logs to send and receive commands from the C2 server without raising any alarms.
News URL
Related news
- Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware (source)
- Microsoft: North Korean hackers join Qilin ransomware gang (source)
- Microsoft admits GitHub hosted malware that infected almost a million devices (source)
- Chinese Hackers Breach Juniper Networks Routers With Custom Backdoors and Rootkits (source)
- Microsoft: New RAT malware used for crypto theft, reconnaissance (source)
- New ‘Rules File Backdoor’ Attack Lets Hackers Inject Malicious Code via AI Code Editors (source)
- Microsoft Trust Signing service abused to code-sign malware (source)
- Microsoft Trusted Signing service abused to code-sign malware (source)
- New Android malware uses Microsoft’s .NET MAUI to evade detection (source)
- Chinese FamousSparrow hackers deploy upgraded malware in attacks (source)