FoggyWeb

Malware & Tools · FoggyWeb

· MalwareS0661 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

FoggyWeb is a passive and highly-targeted backdoor capable of remotely exfiltrating sensitive information from a compromised Active Directory Federated Services (AD FS) server. It has been used by APT29 since at least early April 2021.(Citation: MSTIC FoggyWeb September 2021)

Tactic Coverage

stealth (7)collection (3)discovery (3)command and control (3)execution (3)credential access (2)exfiltration (1)lateral movement (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (21)

T1005Data from Local System

collection

T1027.004Compile After Delivery

stealth

T1027.013Encrypted/Encoded File

stealth

T1036Masquerading

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1040Network Sniffing

credential accessdiscovery

References

https://attack.mitre.org/software/S0661 https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/