The SessionManager IIS backdoor
SessionManager has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East, starting from at least March 2021.
Because of the similar victims, and use of a common OwlProxy variant, ESET believe the malicious IIS module may have been leveraged by the GELSEMIUM threat actor, as part of espionage operations.
Featured Resources
blog
Exploiting BadSuccessor: Cymulate Launches New Advanced Breach Simulation Scenario
At Cymulate, our mission is to stay ahead of evolving threats by transforming cutting-edge research into real-world security testing tools.
blog
11 Email Threats Your Organization Needs to Know
Email remains the primary entry point for cyberattacks. From nation-state actors to low-level cybercriminals, adversaries continually exploit the ubiquity and
blog
Proactive Security in Action: What Real-World Gaps Reveal About Cyber Resilience
Today’s threat actors move fast, and reactive security is no longer enough. Most breaches have a common root cause: a