FoggyWeb Backdoor Detection
Table of contents:
Microsoft has recently uncovered yet another piece of malware leveraged by the infamous NOBELIUM APT group since spring 2021. The new threat, dubbed FoggyWeb, acts as a post-exploitation backdoor able to exfiltrate information from Active Directory Federation Services (AD FS) servers. Malware has been used in targeted attacks against multiple organizations globally while staying unnoticed for months.
NOBELIUM APT
NOBELIUM is a relatively new player in the cyber threat arena, with the first red flags of APT’s activity traced back to the end of 2019. Since then, NOBELIUM earned a reputation as a highly sophisticated hacking collective leveraging an impressive batch of custom malware samples to proceed with the epoch-making attacks.Â
According to Microsoft, NOBELIUM APT stands behind the SolarWinds supply-chain attack and targeted spear-phishing campaign against major government agencies and NGOs globally. Also, this group developed such notorious malware samples as Sunburst, Sunspot, Teardrop, Goldmax, Sibot, and GoldFinder.
NOBELIUM is believed to be an active unit of the infamous Russian state-sponsored APT29 group (Cozy Bear, The Dukes) that works on behalf of the Russian Foreign Intelligence Service (SVR).
What is FoggyWeb?
Similar to other samples in the NOBELIUM toolkit, FoggyWeb is a highly-targeted, passive backdoor applied to get admin level of access on the compromised AD FS servers. It is able to misuse the Security Assertion Markup Language (SAML) token, usually applied for smooth user authentication, to gain persistent access to AD FS resources. Abusing the SAML standard is not new for the NOBELIUM APT. Previously the group has been spotted to leverage the Golden SAML attack method to scale a compromise related to the SolarWinds hack.
Once adversaries obtain initial access to the AD FS server, they deploy FoggyWeb to grab the configuration database, decrypted token-signing certificates, and token-decryption certificates. This highly sensitive data allows hackers to penetrate employees’ cloud accounts within the organizational infrastructure.
Except for data exfiltration functionality, FoggyWeb can also execute additional malicious code received from the attackers’ command-and-control (C&C) server, the analysis by Microsoft Threat Intelligence Center (MSTIC) details.Â
Detecting FoggyWeb Backdoor
To detect possible attacks against your infrastructure and prevent FoggyWeb infection, you can download a community Sigma rule shared by our prolific Threat Bounty contributor Nattatorn Chuensangarun.Â
FoggyWeb Backdoor targeting AD FS Server
This rule monitors the AD FS servers within the organization and spots the presence of specific files associated with NOBELIUM malicious activity.
The detection has translations for the following SIEM SECURITY ANALYTICS platforms: Azure Sentinel, ELK Stack, Chronicle Security, Splunk, Sumo Logic, ArcSight, QRadar, Humio, Microsoft Defender ATP, FireEye, Carbon Black, LogPoint, Graylog, Regex Grep, Microsoft PowerShell, RSA NetWitness, Apache Kafka ksqlDB, Securonix.
The rule is mapped to MITRE ATT&CK methodology addressing the Initial Access tactics and the Exploit Public-Facing Applications technique (t1190) as well as Credential Access tactics and the SAML Tokens sub-technique (t1606.002) of the Forge Web Credentials technique (t1606).
Also, to spot the presence of FoggyWeb backdoor on the organizational infrastructure, you can download a community Sigma behavior-based rule developed by Florian Roth.
This rule detects DLL image load activity as used by the FoggyWeb backdoor loader.
The detection has translations for the following SIEM SECURITY ANALYTICS platforms: Azure Sentinel, ELK Stack, Chronicle Security, Splunk, Sumo Logic, ArcSight, QRadar, Humio, Microsoft Defender ATP, FireEye, Carbon Black, LogPoint, Graylog, Regex Grep, Microsoft PowerShell, RSA NetWitness, Apache Kafka ksqlDB, Securonix, Qualys.
In case of the FoggyWeb presence identified inside your company assets, you can follow a set of mitigation steps provided by Microsoft in its best practices advisory.
Explore the SOC Prime platform to take your cybersecurity experience to the next level. Instantly hunt for the latest threats within 20+ supported SIEM XDR technologies, boost the awareness of all the latest attacks in the context of exploited vulnerabilities and MITRE ATT&CK matrix, and streamline your security operations, while getting anonymized feedback from the global cybersecurity community. Enthusiastic to craft your own detection content and get money for your contribution? Join our Threat Bounty Program!
