A new highly capable and persistent threat actor has been targeting major high-profile public and private entities in the U.S. as part of a series of targeted cyber intrusion attacks by exploiting internet-facing Microsoft Internet Information Services (IIS) servers to infiltrate their networks.
Israeli cybersecurity firm Sygnia, which identified the campaign, is tracking the advanced, stealthy adversary under the moniker βPraying Mantisβ or βTG2021.β
βTG1021 uses a custom-made malware framework, built around a common core, tailor-made for IIS servers. The toolset is completely volatile, reflectively loaded into an affected machineβs memory and leaves little-to-no trace on infected targets,β the researchers said. βThe threat actor also uses an additional stealthy backdoor and several post-exploitations modules to perform network reconnaissance, elevate privileges, and move laterally within networks.β
Besides exhibiting capabilities that show a significant effort to avoid detection by actively interfering with logging mechanisms and successfully evading commercial endpoint detection and response (EDR) systems, the threat actor has been known to leverage an arsenal of ASP.NET web application exploits to gain an initial foothold and backdoor the servers by executing a sophisticated implant named βNodeIISWebβ thatβs designed to load custom DLLs as well as intercept and handle HTTP requests received by the server.
The vulnerabilities that are taken advantage of by the actor include:
Interestingly, Sygniaβs investigation into TG1021βs tactics, techniques, and procedures (TTPs) have unearthed βmajor overlapsβ to those of a nation-sponsored actor named βCopy-Paste Compromises,β as detailed in an advisory released by the Australian Cyber Security Centre (ACSC) in June 2020, which described a cyber campaign targeting public-facing infrastructure primarily through the use of unpatched flaws in Telerik UI and IIS servers. However, a formal attribution is yet to be made.
βPraying Mantis, which has been observed targeting high-profile public and private entities in two major Western markets, exemplifies a growing trend of cyber criminals using sophisticated, nation-state attack methods to target commercial organizations,β the researchers said. βContinuous forensics activities and timely incident response are essential to identifying and effectively defending networks from attacks by similar threat actors.β
Found this article interesting? Follow THN on Facebook, Twitter ο and LinkedIn to read more exclusive content we post.