The SessionManager IIS backdoor
SessionManager has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East, starting from at least March 2021.
Because of the similar victims, and use of a common OwlProxy variant, ESET believe the malicious IIS module may have been leveraged by the GELSEMIUM threat actor, as part of espionage operations.
Featured Resources
View More Resources
blog
Inside the Agentic Cyber Defense Engineering Architecture: How it Works
Agentic cyber defense engineering requires more than adding AI to isolated security tasks. It requires an agentic cyber defense engineering
blog
Trusted by Design? How Headless Claude Code Executed Host Commands Through Repository-Controlled Git Configuration
Imagine an automated code-review service receiving a complete project archive, including its hidden .git metadata, and launching Claude Code to
blog
Agentic Cyber Defense Engineering Model: 6 Requirements and 3 Foundations
Learn the six requirements and three foundations of an agentic cyber defense framework built to improve security faster.