Praying Mantis is now Preying on Microsoft's IIS Servers

The storyline

• The group reportedly exploits an RCE bug in deserialization implementation in an ASP.NET application called Checkbox used to perform user surveys. In addition, it targeted an RCE flaw in Telerik UI for ASP.NET AJAX.
• Actors have been delivering memory-resident malware to perform reconnaissance, credential harvesting, and lateral movement inside the compromised networks.
• The malware used by this group exhibited a great effort to evade detection by meddling with logging mechanisms, successfully evading commercial EDRs, and quietly waiting for incoming connections.

How does exploitation works?

• These RCE flaws are abused to load a malicious DLL into the memory of vulnerable web servers. It then reflectively loads the NodeIISWeb malware into the w3wp[.]exe process.
• Sometimes, the group uses a web shell to load NodeIISWeb instead of a reflective DLL loader.
• NodeIISWeb deploys a custom Windows backdoor, ExtDLL[.]dll, which can be used to gather system info, manipulate files and directories, load and execute DLLs, token manipulation, and code injection.

Conclusion