New Malware Backdoors Microsoft Exchange Servers Worldwide

Share post:

Hackers are using newly detected malware to backdoor Microsoft Exchange servers of government and military organizations from Europe, the Middle East, Asia, and Africa.

The malware, named SessionManager by Kaspersky researchers, who first detected it in early 2022, is a malicious native-code module for the tech giant’s Internet Information Services (IIS) web server software.

It has been used in the wild without being detected since at least March 2021, right after the start of last year’s notorious wave of ProxyLogon attacks.

“The SessionManager backdoor enables threat actors to keep persistent, update-resistant and rather stealth access to the IT infrastructure of a targeted organization,” Kaspersky said on Thursday.

Session Manager has the following features:

  • dropping and managing arbitrary files on compromised servers
  • remote command execution on backdoored devices
  • connecting to endpoints within the victim’s local network and controlling the network traffic

Moreover, Kaspersky in April 2022 found that many of the malware samples detected earlier were still deployed on 34 servers of 24 organizations as late as June 2022.

After deployment, the malicious IIS module enables the attackers to harvest credentials from system memory, obtain information from the victims’ network and infected devices, and deliver more payloads.

According to victimology and the use of an HTTP server-type backdoor variant called OwlProxy, Kaspersky security experts believe the SessionManager IIS backdoor was leveraged in these attacks by the Gelsemium group as part of a global espionage operation.

The Gelsemium APT gang gained infamy for targeting governments, electronics manufacturers, and universities from East Asia and the Middle East and mostly operating under the radar.

For more information, read the original story in Bleepingcomputer.

Featured Tech Jobs


Related articles

Cyber Security Today, April 12, 2024 – A warning to Sisense customers, a new tactic for spreading the Raspberry Robin worm, and more

A warning to Sisense customers, a new tactic for spreading the Raspberry Robin worm, and more. Welcome to Cyber Security Today. It’s Friday April 12th, 2024. I’m Howard Solomon. Organizations that use products from business analytics provider Sisense [SI-SENSE] are being told to reset user login credentials and digital keys. The warning comes from the

LinkedIn introduces verification for recruiters to combat scams

LinkedIn announced today the launch of a new verification process for job recruiters, a move aimed at curtailing...

Cyber Security Today, Week in Review for week ending Friday, April 5, 2024

This episode features a discussion on a highly critical report on the hacking of Microsoft Exchange Online email accounts, a case study of a ransomware attack and the discovery of a years-long infiltration of an open source group to insert a backdoor

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways