Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Privilege Escalation. Show all posts
Web Shell
ASP C2 Infrastructure Cybersecurity IIS server LazarLoader Lazarus Group malware Privilege Escalation Web Shell

Lazarus Group Intensifies Attacks on South Korean Web Servers

 

Researchers have uncovered a series of highly sophisticated cyberattacks by the notorious Lazarus group, targeting web servers in South Korea.

The attackers have been infiltrating IIS servers to deploy ASP-based web shells, which serve as the first-stage Command and Control (C2) servers. These initial C2 servers act as intermediaries, relaying communications to secondary C2 infrastructure, allowing deeper penetration into compromised systems.

First identified in January 2025, these latest attacks showcase an advancement of similar methods observed in May 2024, highlighting the persistent and evolving strategies employed by this state-sponsored group. The Lazarus group has consistently exploited legitimate web servers to establish attack infrastructures, refining their approach over time.

According to the AhnLab Security Intelligence Centre (ASEC), the latest campaign involved the installation of multiple ASP-based web shells on vulnerable IIS servers. One notable addition is the modified version of the "RedHat Hacker" web shell, stored under the filename "function2.asp." Unlike previous versions that used "1234qwer" as the authentication password, the latest variant now requires "2345rdx," reflecting an enhancement in security measures.

Other deployed web shells, such as "file_uploader_ok.asp" and "find_pwd.asp," grant the attackers extensive control over compromised servers. These tools enable file manipulation, process execution, and even SQL query operations.

To evade detection, these web shells employ advanced obfuscation techniques, remaining encoded in VBE format even after initial decoding. This complexity makes security analysis and detection significantly more challenging.

The structure of the malicious code further demonstrates the sophistication of these attacks. Initialization packets are verified by checking whether the second and third bytes contain the string "OK," while the first byte serves as an encryption key.

C2 Script Enhancements

The C2 script utilized in the January 2025 campaign acts as an intermediary between compromised servers and the attackers' infrastructure. Unlike previous versions, the updated script supports both form data and cookie-based communication, demonstrating ongoing refinements in Lazarus’ toolset.

Depending on the "code" field in the form data, the script executes different commands, including:
  • "MidRequest" – Data redirection
  • "ProxyCheck" – Mid Info storage
  • "ReadFile" and "WriteFile" – File manipulation
  • "ClientHello" – Response handling with Mid Info

These commands enable attackers to exert comprehensive control over infiltrated systems.

Beyond web shells, the attackers deployed the LazarLoader malware to download additional payloads. This advanced loader decrypts and executes payloads directly in memory, utilizing a 16-byte key identified as "Node.Js_NpmStart."

The attack sequence typically begins with web shell installation, followed by LazarLoader deployment via the w3wp.exe IIS web server process. To escalate privileges, the attackers use a malware component named "sup.etl," which functions as a packer for bypassing User Account Control (UAC).

Security experts strongly advise administrators to inspect web servers for vulnerabilities that could permit unauthorized file uploads, particularly targeting ASP-based web shells.

To minimize risks, organizations should implement:
  • Strict access controls to prevent lateral movement post-compromise.
  • Regular password rotation for enhanced security.
  • Continuous monitoring for unusual process activity, especially instances where w3wp.exe spawns unexpected processes.
  • Timely security updates to detect and mitigate known 
As Lazarus continues to refine its attack methodologies, proactive security measures are essential in defending against this persistent and highly sophisticated threat actor targeting critical infrastructure worldwide.
Read more »
Vulnerabilities and Exploits
Iran hackers Microsoft Server OilRig Privilege Escalation Vulnerabilities and Exploits

Iranian Attackers Exploit Windows Bug to Elevate Privileges

 

The Iranian state-sponsored hacking outfit APT34, dubbed OilRig, has recently escalated its activity by launching new campaigns against government and vital infrastructure entities in the United Arab Emirates and the Gulf area. 

OilRig employed a new backdoor to target Microsoft Exchange servers and steal passwords, as well as exploiting the Windows CVE-2024-30088 vulnerabilities to escalate their privileges on affected devices, according to Trend Micro researchers. In addition to the activity, FOX Kitten, another Iran-based APT outfit involved in ransomware attacks, and OilRig have been linked by Trend Micro. 

The attacks observed by Trend Micro start with the exploitation of an unprotected web server to upload a web shell, enabling the hackers to execute remote code and PowerShell commands. Once the web shell is activated, OilRig uses it to launch additional tools, including a component that exploits the Windows CVE-2024-30088 bug. 

CVE-2024-30088 is a high-severity privilege escalation vulnerability that Microsoft patched in June 2024, allowing attackers to elevate their privileges to the SYSTEM level and gain significant control over the compromised devices. 

Microsoft has identified a proof-of-concept exploit for CVE-2024-30088, although it hasn't yet disclosed on its security portal that the vulnerability is being actively exploited. Furthermore, CISA has not listed it as having been previously exploited in its catalogue of known exploited vulnerabilities.

Following a password change event, OilRig downloads and installs 'ngrok,' a remote monitoring and management application that enables covert communications via secure tunnels. This allows the tool to intercept plaintext credentials. 

The use of on-premise Microsoft Exchange servers by threat actors as a means of credential theft and sensitive data exfiltration through fake, difficult-to-identify email traffic is another novel strategy. 

The exfiltration is accomplished using a new backdoor known as 'StealHook,' and Trend Micro claims that government infrastructure is frequently employed as a pivot point to make the operation appear authentic. 

"The key objective of this stage is to capture the stolen passwords and transmit them to the attackers as email attachments," notes Trend Micro in the report. "Additionally, we observed that the threat actors leverage legitimate accounts with stolen passwords to route these emails through government Exchange Servers.”
Read more »
Windows 11
Cyber Security DLL Search Order Hijacking Exploitation Malicious Code Privilege Escalation Security Bypass Security Joes Threat actors Windows 10 Windows 11

New DLL Search Order Hijacking Variant Evades Windows 10 and 11 Protections

 

Security researchers have outlined a fresh variant of a dynamic link library (DLL) search order hijacking technique, potentially enabling threat actors to circumvent security measures and execute malicious code on computers running Microsoft Windows 10 and Windows 11.

The new method, disclosed in a report by cybersecurity firm Security Joes and exclusively shared with The Hacker News, exploits executables commonly present in the trusted WinSxS folder, utilizing the classic DLL search order hijacking technique. By doing so, adversaries can avoid the need for elevated privileges when attempting to run malicious code on a compromised system, introducing potentially vulnerable binaries into the attack chain.

DLL search order hijacking involves manipulating the search order used to load DLLs, allowing the execution of malicious payloads for purposes such as defense evasion, persistence, and privilege escalation. This technique targets applications that do not specify the full path to required libraries, relying on a predefined search order to locate DLLs on disk.

Threat actors exploit this behavior by relocating legitimate system binaries into non-standard directories that contain malicious DLLs, named after legitimate ones. This tricks the system into loading the attack code-containing library instead of the authentic one.

The unique aspect introduced by Security Joes focuses on files within the trusted "C:\Windows\WinSxS" folder. WinSxS, short for Windows side-by-side, is a crucial Windows component used for OS customization and updates to ensure compatibility and integrity.

According to Ido Naor, co-founder and CEO of Security Joes, the discovery diverges from traditional cyber attack methods, providing a more subtle and stealthy exploitation technique. The strategy involves identifying vulnerable binaries in the WinSxS folder and combining them with DLL search order hijacking methods. This entails strategically placing a custom DLL with the same name as a legitimate DLL into an actor-controlled directory, triggering code execution when executing a vulnerable file in the WinSxS folder.

Security Joes emphasized the potential for additional binaries in the WinSxS folder susceptible to this DLL search order hijacking, urging organizations to take precautions. They recommended examining parent-child relationships between processes, particularly focusing on trusted binaries, and closely monitoring activities performed by binaries in the WinSxS folder, including network communications and file operations.
Read more »
Subscribe to: Posts (Atom)