[ad_1]
Malicious actors are deploying a beforehand undiscovered binary, an Web Data Providers (IIS) webserver module dubbed “Owowa,” on Microsoft Change Outlook Internet Entry servers with the aim of stealing credentials and enabling distant command execution.
“Owowa is a C#-developed .NET v4.0 meeting that’s supposed to be loaded as a module inside an IIS net server that additionally exposes Change’s Outlook Internet Entry (OWA),” Kaspersky researchers Paul Rascagneres and Pierre Delcher mentioned. “When loaded this fashion, Owowa will steal credentials which might be entered by any person within the OWA login web page, and can permit a distant operator to run instructions on the underlying server.”
The concept that a rogue IIS module will be usual as a backdoor shouldn’t be new. In August 2021, an exhaustive examine of the IIS menace panorama by Slovak cybersecurity firm ESET revealed as many as 14 malware households that have been developed as native IIS modules in an try to intercept HTTP site visitors and remotely commandeer the compromised computer systems.
As a persistent element on the compromised system, Owawa is engineered to seize the credentials of customers who’re efficiently authenticated on the OWA authentication net web page. Exploitation can then be achieved by sending “seemingly innocuous requests” to the uncovered net providers by coming into particularly crafted instructions throughout the username and password fields within the OWA authentication web page of a compromised server.
Particularly, if the OWA username is “jFuLIXpzRdateYHoVwMlfc,” Owawa responds again with the encrypted credentials. If the username, then again, is “dEUM3jZXaDiob8BrqSy2PQO1”, the PowerShell command typed within the OWA password area is executed, the outcomes of that are despatched again to the attacker.
The Russian safety agency mentioned it detected a cluster of targets with compromised servers situated in Malaysia, Mongolia, Indonesia, and the Philippines that primarily belong to authorities organizations, apart from one server that is connected to a government-owned transportation firm. That mentioned, extra organizations in Europe are believed to have been victimized by the actor as nicely.
Though no hyperlinks have been unearthed between the Owowa operators and different publicly documented hacking teams, a username “S3crt” (learn “secret”) that was discovered embedded within the supply code of the recognized samples has yielded extra malware executables which might be seemingly the work of the identical developer. Chief amongst them are numerous binaries designed to execute an embedded shellcode, load next-stage malware retrieved from a distant server, and set off the execution of Cobalt Strike payloads.
Kaspersky’s International Analysis and Evaluation Crew (GReAT) additionally mentioned it recognized an account with the identical username on Keybase, the place the person has shared offensive instruments reminiscent of Cobalt Strike and Core Affect, along with demonstrating an curiosity within the latter on RAIDForums.
“IIS modules usually are not a standard format for backdoors, particularly when in comparison with typical net utility threats like net shells and might due to this fact simply be missed throughout commonplace file monitoring efforts,” Rascagneres and Delcher mentioned. “The malicious module […] represents an efficient choice for attackers to achieve a powerful foothold in focused networks by persisting inside an Change server.”
[ad_2]
