Microsoft Warns of 'FoggyWeb' Malware Targeting AD FS Servers
The group tracked as Nobelium uses multiple tactics to steal credentials with the goal of gaining admin access to Active Directory Federation Services.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The attack group Microsoft tracks as Nobelium is using a new post-exploitation backdoor capable of stealing sensitive data from a compromised Active Directory Federation Services (AD FS) server, the company reports.
Nobelium is the same group behind last year's massive supply chain attack targeting SolarWinds' Orion software. Since then, Microsoft has provided updates on the attackers' activity, which in May included an advanced email campaign impersonating the US Agency for International Development (USAID).
Now the Microsoft Threat Intelligence Center (MSTIC) says the group is using new malware, dubbed FoggyWeb, as one of multiple tactics to pursue credential theft with the goal of gaining admin-level access to AD FS servers. FoggyWeb has been seen in the wild as early as April 2021, Microsoft says, and customers observed being targeted or compromised have been notified.
FoggyWeb is a "passive and highly targeted backdoor" that can remotely exfiltrate sensitive data from a compromised AD FS server. It can also receive additional malicious commands from a command-and-control (C2) server and execute them on the victim's server.
"Nobelium uses FoggyWeb to remotely exfiltrate the configuration database of compromised AD FS servers, decrypted token-signing certificate, and token-decryption certificate, as well as to download and execute additional components," they write.
Read MSTIC's full blog post for more details and recommendations to harden and secure AD FS deployments.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024