Tag: iis

4 Attack Reports | 0 Vulnerabilities

Attack reports

Analysis of Lazarus Group's Attack Targeting Windows Web Servers

The Lazarus group has been targeting Windows web servers, particularly in South Korea, installing webshells and C2 scripts to use compromised servers as proxies. The attacks involve multiple stages, including the use of LazarLoader malware and privilege escalation tools. The C2 scripts act as proxi…

privilege escalation

Published: March 11, 2025

Downloadable IOCs: 0

Code injection attacks using publicly disclosed ASP.NET machine keys

An unattributed threat actor has been observed exploiting publicly disclosed ASP.NET machine keys to perform ViewState code injection attacks, delivering the Godzilla post-exploitation framework. Over 3,000 publicly disclosed keys have been identified as potentially vulnerable to this attack method…

post-exploitation

Published: February 6, 2025

Downloadable IOCs: 0

Threat Actors Use CVE-2019-18935 to Deliver Reverse Shells and JuicyPotatoNG

In early January 2025, a threat actor was observed exploiting CVE-2019-18935 in Progress Telerik UI for ASP.NET AJAX. The attacker used the IIS worker process to load a reverse shell and execute reconnaissance commands. The infection process involved confirming the availability of the file upload h…

privilege escalation

Published: January 31, 2025

Linked vulnerabilities : CVE-2019-18935

Downloadable IOCs: 4

Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis

This analysis examines two cybersecurity incidents: a web shell attack and a VPN compromise. The web shell attack involved uploading malicious files to a server, executing commands, creating a local admin account, and attempting to establish persistence. The VPN compromise led to lateral movement, …

lateral movement

privilege escalation

defense evasion

Published: October 24, 2024

Linked vulnerabilities : CVE-2020-1472

Downloadable IOCs: 1

Click here to see more Attack Reports