Various APT groups are successfully using Web shell attacks on a more frequent basis.

Dark Reading Staff, Dark Reading

February 5, 2020

1 Min Read

An investigation into the breach of a customer's Web server by Microsoft's Detection and Response Team (DART) found a Web shell attack that had succeeded in moving through most of the ATT&CK matrix before being remediated.

The Web shell was part of an attack that placed files in numerous directories on the Web server, gaining persistence and beginning to spread laterally in the infrastructure before it was discovered, DART notes. DART also says it is seeing Web shells used more frequently by APT groups, including Zinc, Krypton, and Gallium. And the threat is growing: "Every month, Microsoft Defender Advanced Threat Protection (ATP) detects an average of 77,000 web shell and related artifacts on an average of 46,000 distinct machines," DART says.

Read more here.

Edgepromohorizontal.jpgCheck out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "C-Level & Studying for the CISSP."

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights