The SessionManager IIS backdoor
SessionManager has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East, starting from at least March 2021.
Because of the similar victims, and use of a common OwlProxy variant, ESET believe the malicious IIS module may have been leveraged by the GELSEMIUM threat actor, as part of espionage operations.
Featured Resources
View More Resources
CUSTOMERS
Credit Union Boosts Threat Prevention & Detection with Cymulate
Learn how a credit union automated live-data exercises to validate exposure, improve threat readiness, and streamline SecOps.
blog
Validating Cloud Threat Detection with Wiz Defend and Cymulate
Cymulate-Wiz integration enables proven cloud threat detection by simulating real attacks and verifying Wiz Defend.
blog
Kerberos Authentication Relay Via CNAME Abuse
A breakdown of Kerberos authentication relay using CNAME abuse and mitigation considerations.