Security News > 2023 > February > Hackers backdoor Microsoft IIS servers with new Frebniis malware
Hackers are deploying a new malware named 'Frebniss' on Microsoft's Internet Information Services that stealthily executes commands sent via web requests.
Microsoft IIS is a web server software that acts as a web server and a web app hosting platform for services like Outlook on the Web for Microsoft Exchange.
In the attacks seen by Symantec, the hackers abuse an IIS feature called 'Failed Request Event Buffering', responsible for collecting request metadata.
The malware injects malicious code into a specific function of a DLL file that controls FREB to enable the attacker to intercept and monitor all HTTP POST requests sent to the ISS server.
Advanced network traffic monitoring tools might also help detect unusual activity from malware like Frebniis.
In October 2022, Symantec discovered another malware used by the Cranefly hacking group that abused ISS logs to send and receive commands from the C2 server without raising any alarms.
News URL
Related news
- Salt Typhoon hackers backdoor telcos with new GhostSpider malware (source)
- Hackers exploit ProjectSend flaw to backdoor exposed servers (source)
- Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks (source)
- Microsoft: Chinese hackers use Quad7 botnet to steal credentials (source)
- Microsoft confirms Windows Server 2025 blue screen, install issues (source)
- VEILDrive Attack Exploits Microsoft Services to Evade Detection and Distribute Malware (source)
- North Korean Hackers Target Crypto Firms with Hidden Risk Malware on macOS (source)
- North Korean hackers use new macOS malware against crypto firms (source)
- Unpatched Mazda Connect bugs let hackers install persistent malware (source)
- Microsoft blames Windows Server 2025 automatic upgrades on 3rd-party tools (source)