<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,
<div> </div>
<div>I hope everyone is doing well! </div>
<div> </div>
<div>Below is the entry for today. </div>
<div> </div>
<div>08/05/2021 - Diary entry #320:</div>
<div> </div>
<blockquote style="margin-top:0;margin-bottom:0">
<div>
<p>The Internet Information Services (IIS) is a flexible and manageable web server created by Microsoft for use along with the Windows NT servers. It enables developers to create additional modules, expanding its core functionality.</p>
<p><br>
</p>
<p>This week, the analysis of 14 malware families targeting IIS servers were presented at the Black Hat USA security conference. The modularity of this web server is very attractive for threat actors, specially Backdoors and InfoStealers.</p>
<p><br>
</p>
<p>The threats doesn't seem to have connections between them but they were all developed as malicious IIS modules. Their main goal is to process HTTP requests incoming to the compromised server and modify how the server responds to these requests.</p>
<p><br>
</p>
<p>There are five modes on which these threats operate. First, a Backdoor mode, to control the compromised computer remotely; An InfoStealer mode, to intercept the traffic and steal credentials; An Injector mode to serve malicious content; A Proxy mode to transform
the compromised server into a part of a C2 infraestructure for another malware; And finally, a SEO fraud mode to modify the content served to search engine crawlers.</p>
<p><br>
</p>
<p>As a measure to prevent compromise of IIS servers, it's recommended to install only native IIS modules from trusted sources.</p>
</div>
</blockquote>
<div> </div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> </span><font color="#228EBE"><a href="mailto:felipe.duarte@appgate.com" target="_blank" rel="noopener noreferrer" title="mailto:felipe.duarte@appgate.com" style="margin:0px">felipe.tarijon@appgate.com</a></font><br>
O:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>