Microsoft Exchange backdoors abused to spy on NGOs worldwide
The threat actor behind the campaign is called GELSEMIUM
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurity researchers from Kaspersky recently discovered a brand new IIS module, designed to steal credentials that victims type in when logging into their Outlook Web Access (OWA) accounts.
They dubbed the new module backdoor SessionManager, and claim it’s persistent, resistant to updates and stealthy. By leveraging SessionManager, Kaspersky further claims, threat actors can get access to companyemails, can drop other malicious payloads (such asransomware, for example) onto the target network, and manage compromisedserversin utter secrecy.
What makes SessionManager stand out from other similar modules is its poor detection rate. It wasn’t until early 2022 that the module was discovered, and still some of the more popularantivirus programsdo not flag it as malicious.
Gelsemium
According to the report, SessionManager is today deployed in more than 90% of targeted organizations.
The malicious module managed to compromise 34 servers, belonging to 24 organizations located in Europe, the Middle East, South Asia, and Africa. Most of the victims are non-government organizations (NGO), Kaspersky said, but added that there are medical organizations, oil companies, as well as transportation companies, among the victims as well.
While it’s hard to say with absolute certainty who the threat actor is, Kaspersky believes it’s a group known as GELSEMIUM. This is an old threat actor, dating back from 2014, which is known for targeting governments and religious organizations in the Middle East, as well as East Asia.
Best firewalls right now>This Linux backdoor went undetected for 10 years>US warns Chinese hackers have their ‘most advanced’ backdoor yet
Kaspersky believes GELSEMIUM is behind this attack due to the similar profile of victim, and the use of the common “OwlProxy” variant.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Businesses wary of IIS module attacks are advised to check loaded IIS modules on exposed IIS servers regularly, as part of their threat hunting activities, every time a new vulnerability gets announced onMicrosoftserver products.
They should also focus their defensive strategies on detecting lateral movements and data exfiltration.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Rising AI threats are making firms turn back to human intelligence
Thousands of employees could be falling victim to obvious phishing scams every month
Google’s new AI video maker for businesses is now available on Workspace
