{"id":30653,"date":"2021-12-19T10:39:45","date_gmt":"2021-12-19T07:39:45","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=30653"},"modified":"2026-03-28T00:00:48","modified_gmt":"2026-03-27T21:00:48","slug":"hidden-parasite-kaspersky-uncovers-credential-stealing-microsoft-exchange-add-on","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/hidden-parasite-kaspersky-uncovers-credential-stealing-microsoft-exchange-add-on\/","title":{"rendered":"Hidden parasite: Kaspersky uncovers credential-stealing Microsoft Exchange add-on"},"content":{"rendered":"\n

Kaspersky has uncovered a previously unknown IIS module (a piece of software aimed at providing additional features to Microsoft web servers) they have since dubbed Owowa that steals credentials entered by a user when logging into Outlook Web Access (OWA); it also allows the attackers to gain remote control access to the underlying server. Compiled sometime between late 2020 and April 2021, this module is a stealthy theft method that is difficult to detect with network monitoring. It\u2019s also resistant to software updates from Exchange, meaning it can stay hidden on a device for a long time. <\/strong><\/p>\n\n\n\n

In 2021,\u00a0advanced threat actors<\/a>\u00a0were increasingly exploiting vulnerabilities of Microsoft Exchange Server. In\u00a0March<\/a>, four critical vulnerabilities in the servers allowed attackers to gain access to all registered email accounts and execute arbitrary code. While searching for additional potentially malicious implants in Exchange, Kaspersky experts uncovered a malicious module that allows the attackers to steal login credentials for Outlook Web Access and gain remote access control to the underlying server. Kaspersky has dubbed this malicious module Owowa, and its\u00a0malicious capabilities can easily be launched by sending seemingly innocuous requests – in this case, OWA authentication requests.\u00a0\u00a0<\/p>\n\n\n\n

Kaspersky experts believe the module was compiled between late 2020 and April 2021, and it has been seen targeting victims in Malaysia, Mongolia, Indonesia, and the Philippines. Most of the victims were connected with government organizations and another to a state transportation company. It is likely there are additional victims located in Europe.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Detected Owowa targets are located in several regions in Asia<\/em><\/p>\n\n\n\n

The cybercriminals only need to access the OWA log-in page of a compromised server to enter specially crafted commands into the username and password fields. This is an efficient option for attackers to gain a strong foothold in targeted networks by persisting inside an Exchange server.<\/p>\n\n\n\n

Kaspersky researchers could not associate Owowa to any known threat actor. Yet, they did find that it was associated with the username \u201cS3crt\u201d, a developer that may be behind several other malicious binary loaders. However, \u201cS3crt\u201d is a simple derivation of the English word \u201csecret\u201d and could very well be used by multiple individuals. Therefore, it\u2019s also possible that these malicious binary files and Owowa are not connected.<\/p>\n\n\n\n

<\/a>\u201cThe particular danger with Owowa is that an attacker can use the module to passively steal credentials from users who are legitimately accessing web services. This is a far stealthier way to gain remote access than sending phishing emails. In addition, while IIS configuration tools can be leveraged to detect such threats, they are not part of standard file and network monitoring activities, so Owowa might be easily overlooked by security tools<\/em>,\u201d comments Pierre Delcher, Senior Security Researcher with Kaspersky\u2019s Global Research and Analysis Team (GReAT).<\/p>\n\n\n\n

<\/a>\u201cSince Owowa is an IIS module, this also means it persists even if Microsoft Exchange is updated. The good news is, the attackers don\u2019t appear highly sophisticated. Companies should closely monitor Exchange servers since they are highly sensitive and contain all corporate emails. We also recommend considering all running modules as critical and checking them regularly,\u201d<\/em> comments Paul Rascagneres Senior Security Researcher with Kaspersky\u2019s GReAT.<\/p>\n\n\n\n

Read the full report about Owowa on\u00a0Securelist<\/a>.<\/p>\n\n\n\n

To protect yourself from such threats, Kaspersky recommends:<\/strong><\/p>\n\n\n\n