The SessionManager IIS backdoor
SessionManager has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East, starting from at least March 2021.
Because of the similar victims, and use of a common OwlProxy variant, ESET believe the malicious IIS module may have been leveraged by the GELSEMIUM threat actor, as part of espionage operations.
Featured Resources
blog
How to Stay Ahead of IoT Security Issues
From connected medical equipment in smart hospitals to telemetry sensors in industrial plants, Internet of Things (IoT) devices are now
blog
10 Types of Network Attacks: Common Threats and How to Prevent Them
Network attacks have evolved far beyond simple brute-force intrusions or spam. Threat actors now employ complex, multi-vector tactics that can
Two Pager
Proactive, AI-Powered SIEM Rule Validation and Detection Engineering
Save time and resources by automating the most critical tasks in modern SecOps