Microsoft Exchange backdoors abused to spy on NGOs worldwide TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. Microsoft Exchange backdoors abused to spy on NGOs worldwide By Sead Fadilpašić published 1 July 2022 The threat actor behind the campaign is called GELSEMIUM (Image credit: Pixabay) Audio player loading… Cybersecurity researchers from Kaspersky recently discovered a brand new IIS module, designed to steal credentials that victims type in when logging into their Outlook Web Access (OWA) accounts. They dubbed the new module backdoor SessionManager, and claim it's persistent, resistant to updates and stealthy. By leveraging SessionManager, Kaspersky further claims, threat actors can get access to company emails, can drop other malicious payloads (such as ransomware, for example) onto the target network, and manage compromised servers in utter secrecy. What makes SessionManager stand out from other similar modules is its poor detection rate. It wasn't until early 2022 that the module was discovered, and still some of the more popular antivirus programs (opens in new tab) do not flag it as malicious. Gelsemium According to the report, SessionManager is today deployed in more than 90% of targeted organizations. The malicious module managed to compromise 34 servers, belonging to 24 organizations located in Europe, the Middle East, South Asia, and Africa. Most of the victims are non-government organizations (NGO), Kaspersky said, but added that there are medical organizations, oil companies, as well as transportation companies, among the victims as well. While it's hard to say with absolute certainty who the threat actor is, Kaspersky believes it's a group known as GELSEMIUM. This is an old threat actor, dating back from 2014, which is known for targeting governments and religious organizations in the Middle East, as well as East Asia.Read more> Best firewalls right now (opens in new tab) > This Linux backdoor went undetected for 10 years (opens in new tab) > US warns Chinese hackers have their 'most advanced' backdoor yet (opens in new tab) Kaspersky believes GELSEMIUM is behind this attack due to the similar profile of victim, and the use of the common "OwlProxy" variant. Businesses wary of IIS module attacks are advised to check loaded IIS modules on exposed IIS servers regularly, as part of their threat hunting activities, every time a new vulnerability gets announced on Microsoft server products. They should also focus their defensive strategies on detecting lateral movements and data exfiltration.These are the best endpoint protection (opens in new tab) services right now Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me2Stop saying Mario doesn't have an accent in The Super Mario Bros. Movie3Google Pixel Tablet is what Apple should've done ages ago4RTX 4090 too expensive? Nvidia resurrects another old favorite5More than one million credit card details leaked online1The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me2iPhone 15 tipped to come with an upgraded 5G chip3If this feature succeeds for Modern Warfare 2, Microsoft can't ignore it4Apple October launches: the new devices we might see this month5The Rings of Power episode 8 trailer feels like one big Sauron misdirect Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)