{"id":34887,"date":"2022-07-04T11:58:50","date_gmt":"2022-07-04T08:58:50","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=34887"},"modified":"2026-03-28T01:14:31","modified_gmt":"2026-03-27T22:14:31","slug":"kaspersky-discovers-a-new-backdoor-targeting-governments-and-ngos-across-the-middle-east-turkey-and-africa","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-discovers-a-new-backdoor-targeting-governments-and-ngos-across-the-middle-east-turkey-and-africa\/","title":{"rendered":"Kaspersky discovers a new backdoor targeting governments and NGOs across the Middle East, Turkey and Africa"},"content":{"rendered":"\n

Kaspersky experts have brought to light a poorly detected SessionManager backdoor that was set up as a malicious module within the Internet Information Services (IIS), a popular web server edited by Microsoft. Once propagated, SessionManager enables a wide range of malicious activities, starting from collecting emails to complete control over the victim\u2019s infrastructure. First leveraged in late March 2021, the newly discovered backdoor has hit governmental institutions and NGOs across the globe with victims in eight countries from the Middle East, Turkey and Africa region, including Kuwait, Saudi Arabia, Nigeria, Kenya and Turkey. <\/strong><\/p>\n\n\n\n

In December 2021, Kaspersky uncovered \u201cOwowa<\/a>\u201d, a previously unknown IIS module that steals credentials entered by a user when logging into Outlook Web Access (OWA). Since then, the company\u2019s experts have kept an eye on the new opportunity for cybercriminal activity \u2013 it has become clear that deploying a backdoor within IIS is a trend for threat actors, who previously exploited one of the \u201cProxyLogon-type<\/a>\u201d vulnerabilities within Microsoft Exchange servers. In a recent investigation, Kaspersky experts came across a new unwanted module backdoor, dubbed SessionManager.\u00a0<\/p>\n\n\n\n

The SessionManager backdoor enables threat actors to keep persistent, update-resistant and rather stealth access to the IT infrastructure of a targeted organization. Once dropped into the victim\u2019s system, cybercriminals behind the backdoor can gain access to company emails, update further malicious access by installing other types of malware or clandestinely manage compromised servers, which can be leveraged as malicious infrastructure.<\/p>\n\n\n\n

A distinctive feature of SessionManager is its poor detection rate. First discovered by Kaspersky researchers in early 2022, some of the backdoor samples were still not flagged as malicious in most popular online file scanning services. To date, SessionManager is still deployed in more than 90% of targeted organizations according to an Internet scan carried out by Kaspersky researchers. <\/p>\n\n\n\n

Overall, 34 servers of 24 organizations from Europe, the Middle East, South Asia and Africa were compromised by SessionManager. The threat actor who operates SessionManager shows a special interest in NGOs and government entities, but medical organizations, oil companies, transportation companies, among others, have been targeted as well.<\/p>\n\n\n\n

\"4-7-22_ssict_835_575\"<\/a>
Map of organizations targeted by SessionManager campaign<\/em><\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

Because of a similar victimology and the use of the common \u201cOwlProxy<\/a>\u201d variant, Kaspersky experts believe that the malicious IIS module might have been leveraged by the\u00a0GELSEMIUM<\/a>\u00a0threat actor, as part of its espionage operations.<\/p>\n\n\n\n

\u201cThe exploitation of exchange server vulnerabilities has been a  favorite of cybercriminals looking to get into targeted infrastructure since Q1 2021. It notably enabled a series of long unnoticed cyberespionage campaigns. The recently discovered SessionManager was poorly detected for a year. Facing massive and unprecedented server-side vulnerability exploitation, most cybersecurity actors were busy investigating and responding to the first identified offences. As a result, it is still possible to discover related malicious activities months or years later, and this will probably be the case for a long time,<\/em>\u201d comments Pierre Delcher, Senior Security Researcher at Kaspersky\u2019s Global Research and Analysis team.<\/p>\n\n\n\n

\u201cGaining visibility into actual and recent cyberthreats is paramount for companies to protect their assets. Such attacks may result in significant financial or reputational losses and may disrupt a target\u2019s operations. Threat intelligence is the only component that can enable reliable and timely anticipation of such threats. In the case of Exchange servers, we cannot stress it enough: the past-year\u2019s vulnerabilities have made them perfect targets, whatever the malicious intent, so they should be carefully audited and monitored for hidden implants, if they were not already,\u201d<\/em> adds Pierre.<\/p>\n\n\n\n

Kaspersky products detect several malicious IIS modules, including SessionManager.<\/p>\n\n\n\n

To learn more about SessionManager\u2019s operation style and targets, visit\u00a0Securelist.com<\/a>.<\/p>\n\n\n\n

To protect your businesses from such threats, Kaspersky experts also recommend that you:<\/p>\n\n\n\n