IISpyMalware
- BadIIS
Last reported 3 months ago, by Huntress1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“Defenders often prioritize preventing threat actors from getting in, whether through vulnerability exploitation or exposed Remote Desktop Protocol (RDP) instances.”
- T1543.003Windows Service
“…for the cryptocurrency miner using nssm.exe, the "non-sucking service manager", a freely available utility for creating a resilient Windows service from a standalone executable.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Threat Actors Achieve Persistence After SQL Injection“…ent where a threat actor made an exceptionally broad range of post-compromise modifications across an organization, including installing BadIIS modules, adding new users accounts, and more.”
Indicators in its reports
named in the reports above- hxxp://334thribetlhkyo977gqrcht1k7bvdj2.oastify[.]comin 1 report
- 334thribetlhkyo977gqrcht1k7bvdj2.oastify[.]comin 1 report
- pub-c4c8e8c336c3429d97195076bf3bb6eb.r2[.]devin 1 report
- c4c8e8c336c3429d97195076bf3bb6ebin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.