Tuesday, May 28, 2024

Lazarus APT Group Hijack Windows IIS Servers to Distribute Malware

Threat actors always search for vulnerable devices and networks to gain illicit access and perform malicious activities to accomplish their goals.

The APT group, Lazarus, as an initial breach path actively targeting the Microsoft Internet Information Services (IIS) servers.

Cybersecurity researchers at AhnLab Security Emergency Response Center (ASEC) recently confirmed that operators of the Lazarus group targeted the vulnerable Windows servers to use them as a malicious code distribution server.

Lazarus group employs watering hole attacks, manipulating domestic websites, and exploiting INISAFE CrossWeb EX V6 vulnerabilities for malware distribution.

Despite the patched INITECH vulnerability, recent exploits persist, leveraging compromised IIS servers for distribution of the malware.

Lazarus’ Attacking IIS server

Lazarus’ attack on the IIS server was highlighted in May 2023, revealing exploitation of insecure web servers and attempted lateral movement via RDP.

Attackers exploit vulnerable web servers, installing web shells or executing malicious commands, leveraging matching vulnerabilities for unauthorized actions that are performed by w3wp.exe, an IIS web server process.

Malicious code generated by the IIS web server (Source – AhnLab)

While the IIS web server process, w3wp(.)exe spawns usopriv.exe, a Themida-packed JuicyPotato malware responsible for privilege escalation, one among multiple Potato-based malicious codes.

JuicyPotato (Source – AhnLab)

Attacker-controlled web shells or dictionary attacks lack sufficient privileges to execute desired malicious actions within w3wp.exe, and similar limitations apply to the MS-SQL server’s sqlservr.exe process.

However, threat actors use privilege escalation malware often to overcome this obstacle. Here below, we have mentioned all the commands that are executed by the threat actors using JuicyPotato:-

%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata
%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata
%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata\nueio.txt
%SystemRoot%\system32\cmd.exe /c rundll32 c:\programdata\usoshered.dat ,usoprivfunc 4729858204985024133
%SystemRoot%\system32\cmd.exe /c del c:\programdata\nueio.txt
%SystemRoot%\system32\cmd.exe /c whoami > c:\users\%ASD%\desktop\ngc\test.txt

The attacker utilized JuicyPotato to execute Loader malware, employing rundll32 with a random string argument to execute the DLL-formatted payload.

Loader decodes data file name to obtain ‘{20D1BF68-64EE-489D-9229-95FEFE5F12A4}’, confirming its presence in multiple paths.

An unsecured file in the relevant path confirms Loader malware, decrypting and executing encoded data file in memory.

Name of the decrypted data file (Source – AhnLab)

Lazarus group combines Loader malware with encrypted data files, decoding and executing them in memory.

While specific data files remain unverified, past cases indicate the final executed malware is typically a downloader or backdoor.

The attacker exploited the INISAFE vulnerability to install “SCSKAppLink.dll” as additional malicious code, with the IIS web server serving as the download source. 

INISAFE vulnerability (Source – AhnLab)

Though it’s not confirmed, “SCSKAppLink.dll” appears similar to Lazarus Attack Group’s previous malicious code exploiting the INITECH process, functioning as a downloader, and enabling remote control through the installation of specified malware.

Lazarus is one of the highly sophisticated APT groups that use several types of stealthy attack vectors.

Security analysts urged users to remain vigilant and deploy an up-to-date patch management system.



– 280152dfeb6d3123789138c0a396f30d : JuicyPotato (usopriv.exe)
– d0572a2dd4da042f1c64b542e24549d9 : Loader (usoshered.dat)

Latest articles

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...

Google Patches Chrome Zero-Day: Type Confusion in V8 JavaScript

Google has released a patch for a zero-day exploit in its Chrome browser.The...

Hackers Created Rogue VMs in Recent MITRE’s Cyber Attack

State-sponsored hackers recently exploited vulnerabilities in MITRE's Networked Experimentation, Research, and Virtualization Environment (NERVE).They...

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles