Wednesday, December 6, 2023

Lazarus APT Group Hijack Windows IIS Servers to Distribute Malware

Threat actors always search for vulnerable devices and networks to gain illicit access and perform malicious activities to accomplish their goals.

The APT group, Lazarus, as an initial breach path actively targeting the Microsoft Internet Information Services (IIS) servers.

Cybersecurity researchers at AhnLab Security Emergency Response Center (ASEC) recently confirmed that operators of the Lazarus group targeted the vulnerable Windows servers to use them as a malicious code distribution server.

Lazarus group employs watering hole attacks, manipulating domestic websites, and exploiting INISAFE CrossWeb EX V6 vulnerabilities for malware distribution.

Despite the patched INITECH vulnerability, recent exploits persist, leveraging compromised IIS servers for distribution of the malware.

Lazarus’ Attacking IIS server

Lazarus’ attack on the IIS server was highlighted in May 2023, revealing exploitation of insecure web servers and attempted lateral movement via RDP.

Attackers exploit vulnerable web servers, installing web shells or executing malicious commands, leveraging matching vulnerabilities for unauthorized actions that are performed by w3wp.exe, an IIS web server process.

Malicious code generated by the IIS web server (Source – AhnLab)

While the IIS web server process, w3wp(.)exe spawns usopriv.exe, a Themida-packed JuicyPotato malware responsible for privilege escalation, one among multiple Potato-based malicious codes.

JuicyPotato (Source – AhnLab)

Attacker-controlled web shells or dictionary attacks lack sufficient privileges to execute desired malicious actions within w3wp.exe, and similar limitations apply to the MS-SQL server’s sqlservr.exe process.

However, threat actors use privilege escalation malware often to overcome this obstacle. Here below, we have mentioned all the commands that are executed by the threat actors using JuicyPotato:-

%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata
%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata
%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata\nueio.txt
%SystemRoot%\system32\cmd.exe /c rundll32 c:\programdata\usoshered.dat ,usoprivfunc 4729858204985024133
%SystemRoot%\system32\cmd.exe /c del c:\programdata\nueio.txt
%SystemRoot%\system32\cmd.exe /c whoami > c:\users\%ASD%\desktop\ngc\test.txt

The attacker utilized JuicyPotato to execute Loader malware, employing rundll32 with a random string argument to execute the DLL-formatted payload.

Loader decodes data file name to obtain ‘{20D1BF68-64EE-489D-9229-95FEFE5F12A4}’, confirming its presence in multiple paths.

An unsecured file in the relevant path confirms Loader malware, decrypting and executing encoded data file in memory.

Name of the decrypted data file (Source – AhnLab)

Lazarus group combines Loader malware with encrypted data files, decoding and executing them in memory.

While specific data files remain unverified, past cases indicate the final executed malware is typically a downloader or backdoor.

The attacker exploited the INISAFE vulnerability to install “SCSKAppLink.dll” as additional malicious code, with the IIS web server serving as the download source. 

INISAFE vulnerability (Source – AhnLab)

Though it’s not confirmed, “SCSKAppLink.dll” appears similar to Lazarus Attack Group’s previous malicious code exploiting the INITECH process, functioning as a downloader, and enabling remote control through the installation of specified malware.

Lazarus is one of the highly sophisticated APT groups that use several types of stealthy attack vectors.

Security analysts urged users to remain vigilant and deploy an up-to-date patch management system.



– 280152dfeb6d3123789138c0a396f30d : JuicyPotato (usopriv.exe)
– d0572a2dd4da042f1c64b542e24549d9 : Loader (usoshered.dat)

Latest articles

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

Serpent Stealer Acquires Browser Passwords and Erases Intrusion Logs

Beneath the surface of the cyber realm, a silent menace emerges—crafted with the precision...

Doppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks

It has been observed that threat actors are using AI technology to conduct illicit...

Kali Linux 2023.4 Released – What’s New!

Kali Linux 2023.4, the latest version of Offensive Security's renowned operating system, has been...

Trickbot Malware Developer Pleads Guilty & Faces 35 Years in Prison

A 40-year-old Russian national, Vladimir Dunaev, pleaded guilty for developing and deploying Trickbot malware....

ICANN Launches RDRS to Assist Law Enforcement Agencies to Discover Private Info

ICANN is a non-profit organization that is responsible for coordinating the global internet's-DNSIP address...

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles