Lazarus APT Group Hijack Windows IIS Servers to Distribute Malware

Threat actors always search for vulnerable devices and networks to gain illicit access and perform malicious activities to accomplish their goals.

The APT group, Lazarus, as an initial breach path actively targeting the Microsoft Internet Information Services (IIS) servers.

Cybersecurity researchers at AhnLab Security Emergency Response Center (ASEC) recently confirmed that operators of the Lazarus group targeted the vulnerable Windows servers to use them as a malicious code distribution server.

Lazarus group employs watering hole attacks, manipulating domestic websites, and exploiting INISAFE CrossWeb EX V6 vulnerabilities for malware distribution.

Despite the patched INITECH vulnerability, recent exploits persist, leveraging compromised IIS servers for distribution of the malware.

Lazarus’ Attacking IIS server

Lazarus’ attack on the IIS server was highlighted in May 2023, revealing exploitation of insecure web servers and attempted lateral movement via RDP.

Attackers exploit vulnerable web servers, installing web shells or executing malicious commands, leveraging matching vulnerabilities for unauthorized actions that are performed by w3wp.exe, an IIS web server process.

While the IIS web server process, w3wp(.)exe spawns usopriv.exe, a Themida-packed JuicyPotato malware responsible for privilege escalation, one among multiple Potato-based malicious codes.

Attacker-controlled web shells or dictionary attacks lack sufficient privileges to execute desired malicious actions within w3wp.exe, and similar limitations apply to the MS-SQL server’s sqlservr.exe process.

However, threat actors use privilege escalation malware often to overcome this obstacle. Here below, we have mentioned all the commands that are executed by the threat actors using JuicyPotato:-

%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata
%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata
%SystemRoot%\system32\cmd.exe /c whoami > c:\programdata\nueio.txt
%SystemRoot%\system32\cmd.exe /c rundll32 c:\programdata\usoshered.dat ,usoprivfunc 4729858204985024133
%SystemRoot%\system32\cmd.exe /c del c:\programdata\nueio.txt
%SystemRoot%\system32\cmd.exe /c whoami > c:\users\%ASD%\desktop\ngc\test.txt

The attacker utilized JuicyPotato to execute Loader malware, employing rundll32 with a random string argument to execute the DLL-formatted payload.

Loader decodes data file name to obtain ‘{20D1BF68-64EE-489D-9229-95FEFE5F12A4}’, confirming its presence in multiple paths.

An unsecured file in the relevant path confirms Loader malware, decrypting and executing encoded data file in memory.

Lazarus group combines Loader malware with encrypted data files, decoding and executing them in memory.

While specific data files remain unverified, past cases indicate the final executed malware is typically a downloader or backdoor.

The attacker exploited the INISAFE vulnerability to install “SCSKAppLink.dll” as additional malicious code, with the IIS web server serving as the download source. 

Though it’s not confirmed, “SCSKAppLink.dll” appears similar to Lazarus Attack Group’s previous malicious code exploiting the INITECH process, functioning as a downloader, and enabling remote control through the installation of specified malware.

Lazarus is one of the highly sophisticated APT groups that use several types of stealthy attack vectors.

Security analysts urged users to remain vigilant and deploy an up-to-date patch management system.

IOC

MD5

– 280152dfeb6d3123789138c0a396f30d : JuicyPotato (usopriv.exe)
– d0572a2dd4da042f1c64b542e24549d9 : Loader (usoshered.dat)