ctrlINT What the industry said about every indicator, with the quote

FoggyWebMalware

FoggyWeb is a passive and highly-targeted backdoor capable of remotely exfiltrating sensitive information from a compromised Active Directory Federated Services (AD FS) server. It has been used by APT29 since at least early April 2021.From MITRE ATT&CK

Last reported 3 years ago, by Huntress1 report

ATT&CK techniques

4 techniques · each with the sentence it comes from
  1. T1053.005Scheduled Task

    “…king to establish themselves within the victim environment through creating adversary-controlled, privileged accounts and creating a scheduled task for persistence mechanisms as well.”

    HuntressVendor
  2. T1055Process Injection

    “Description: Obfuscated PowerShell script, likely for process injection.”

    HuntressVendor
  3. T1505.003Web Shell

    “Based on intrusion information, Huntress identified two web shell items.”

    HuntressVendor
  4. T1684Social Engineering

    “Netscaler Exploitation to Social Engineering”

    HuntressVendor

What the reports say

1 report, newest first · the exact sentence from each

  1. “…represents DLL search order hijacking or sideloading attempts, as seen in examples ranging from state-sponsored threat actor Nobelium’s FoggyWeb backdoor installation to abuse of signed Microsoft executables to install Brute Ratel.”

    HuntressVendor
    Netscaler Exploitation to Social Engineering

Indicators in its reports

named in the reports above
Copy these 17 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with FoggyWeb here?
No account needed. We do not store your IP address.