REF3927 abuses publicly disclosed ASP.NET machine keys to compromise IIS servers and deploy TOLLBOOTH SEO cloaking modules globally.

Introduction

Key takeaways

Campaign Overview

Attack vector

Post-compromise activity

Godzilla EKP analysis

Rootkit analysis

InitializeConfigs

InitializeKernelAnalyzer

LookForPspCidTable

LookForActiveProcessLinks

InitializePsMonitor

Registering object manager callback with (ObRegisterCallbacks)

Process Creation Callback(PsSetCreateProcessNotifyRoutineEx)

The Image Load callback (PsSetLoadImageNotifyRoutine)

InitializeFSMiniFilter

FltCreatePreOperation(IRP_MJ_CREATE)

FltDirCtrlPostOperation(IRP_MJ_DIRECTORY_CONTROL)

InitializeRegistryFilter

InitializeDevice

InitializeStealthMode

Code Variations

RMM usage

IIS module analysis

Malware Config Structure

Webshell

Management Channel

SEO Cloaking

Page Hijacker

Campaign targeting

Geography

Diamond model

Remediating REF3927

Conclusion

Detection logic

Detection rules

Prevention rules

YARA signatures

REF3927 through MITRE ATT&CK

Tactics

Techniques

Observations

References

Addendum

TOLLBOOTH: What's yours, IIS mine

Author

Braxton Williams

Articles

TOLLBOOTH: What's yours, IIS mine

TOLLBOOTH: What's yours, IIS mine