IISpy

MITRE ATT&CK techniques ... T1587.001 Develop Capabilities: Malware — IISpy is a custom-made malware family.

Operators of IISpy have used Juicy Potato, a local privilege escalation tool.

We suspect the attackers first obtain initial access to the IIS server via some vulnerability... MITRE ATT&CK techniques ... T1190 Exploit Public-Facing Application.

IISpy supports a backdoor command that uses the Windows command shell to execute shell commands on the compromised IIS server.

MITRE ATT&CK techniques ... T1569.002 System Services: Service Execution — IIS server (and by extension, IISpy) persists as a Windows service.

IISpy is loaded by IIS Worker Process (w3wp.exe) when the IIS server receives an inbound HTTP request.

According to ESET telemetry, this backdoor has been active since at least July 2020, and has been used with Juicy Potato ... to obtain the administrative privileges that are required to install IISpy as a native IIS extension.

If the credentials are present, IISpy uses them to log in as the user (via LogonUserW, ImpersonateLoggedOnUser) to execute the backdoor commands in the user’s context.

IISpy is loaded by IIS Worker Process (w3wp.exe) when the IIS server receives an inbound HTTP request.

IISpy implements the OnLogRequest event handler ... to modify the log entries for requests coming from the attackers to make them look like casual requests.

IISpy supports a backdoor command to modify file timestamps.

If the credentials are present, IISpy uses them to log in as the user (via LogonUserW, ImpersonateLoggedOnUser) to execute the backdoor commands in the user’s context.

The following backdoor commands are supported ... Upload/download files ... Create/list/move/rename/delete files and folders ... Exfiltrate collected data.

IISpy operators send commands with a specially constructed combination of URLs, Host headers and cookies. IISpy exfiltrates data in a fake PNG file ... in an attempt to make its C&C traffic look like regular network traffic.

IISpy uses this channel to implement its C&C communication, which allows it to operate as a passive network implant ... the operator initiates the connection by sending a special HTTP request to the compromised server.

IISpy supports a backdoor command to upload additional tools to the compromised IIS server.

Backdoor commands are embedded in the HTTP body, AES-CBC encrypted and base64 encoded ... IISpy encodes the C&C communication with base64 encoding.

Both sides of the C&C communication are AES-CBC encrypted ... IISpy uses AES-CBC to encrypt C&C communication.

IISpy supports a backdoor command to exfiltrate data and files from the compromised IIS server.