GhostContainer: New vulnerability attacks Microsoft Exchange servers via backdoor malware

The GReAT team discovered the malware during incident response efforts at government systems that used Microsoft Exchange. GhostContainer is believed to be part of a sophisticated and persistent advanced persistent threat (APT) campaign targeting key organizations in the Asia region, including major technology companies.

The malicious file discovered by Kaspersky, called App_Web_Container_1.dll, is actually a multi-functional backdoor that can be extended by downloading additional modules remotely. The malware takes advantage of many open source projects and is sophisticatedly customized to avoid detection.

Once GhostContainer is successfully installed on a system, hackers can easily gain complete control of the Exchange server, from which they can perform a series of dangerous actions without the user's knowledge. This malware is cleverly disguised as a valid server component and uses many surveillance evasion techniques to avoid detection by antivirus software and bypass security monitoring systems.

In addition, this malware can act as an intermediary server (proxy) or an encrypted tunnel (tunnel), creating loopholes for hackers to penetrate internal systems or steal sensitive information. Looking at this way of operating, experts suspect that the main purpose of this campaign is most likely cyber espionage.

“Our in-depth analysis shows that the perpetrators are highly proficient in penetrating Microsoft Exchange servers. They leverage a variety of open source tools to penetrate IIS and Exchange environments, and have developed sophisticated spying tools based on available open source code. We will continue to monitor the group’s activities, as well as the scope and severity of their attacks, to better understand the overall threat landscape,” said Sergey Lozhkin, Head of the Global Research and Analysis Team (GReAT) for Asia Pacific and Middle East and Africa at Kaspersky.

Source: https://www.sggp.org.vn/ghostcontainer-lo-hong-moi-tan-cong-may-chu-microsoft-exchange-thong-qua-ma-doc-backdoor-post805372.html