FoggyWeb

Malware Profile Updated 24 days ago
Download STIX
Preview STIX
FoggyWeb is a type of malware recently discovered by Microsoft that hackers are using to remotely steal network admin credentials. The malware, which has been in use since as early as April 2021, is employed by the hacker group NOBELIUM to remotely exfiltrate the configuration database of compromised Active Directory Federation Services (AD FS) servers. This includes decrypted token-signing and token-decryption certificates, allowing for the download and execution of additional components. FoggyWeb's operations are facilitated through direct interaction with the AD FS codebase, rather than through an external disk-resident tool. The FoggyWeb malware was built on previous post-exploitation tools such as MagicWeb, first described by Microsoft in August 2022. MagicWeb, like FoggyWeb, could steal certificates from AD FS servers. The malware operates by loading the FoggyWeb DLL into one or more application domains where the legitimate AD FS code is running. After being loaded into the current application domain, the loader invokes a specific method from the DLL: Microsoft.IdentityServer.WebExtension.WebHost. In its operational cycle, FoggyWeb creates a Safe Array and copies the decrypted backdoor bytes to the array. This allows the malware to selectively invoke native AD FS methods needed to facilitate its malicious operations. The use of FoggyWeb poses significant risks to network security due to its ability to steal network admin credentials and interact directly with server codebases, highlighting the need for robust cybersecurity measures to prevent such exploits.
What's your take? (Question 1 of 5)
c28195a5-a0ad-44b9-8d9b-06ce1f348942 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Microsoft
Malware
exploitation
Backdoor
Exploit
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
NOBELIUMUnspecified
2
Nobelium, a threat actor also known as Midnight Blizzard and Cozy Bear, is a Russian state-sponsored entity notorious for executing actions with malicious intent. Known for its sophisticated methods, Nobelium uses a tool called FoggyWeb to remotely exfiltrate the configuration database of compromise
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the FoggyWeb Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
MITRE
a year ago
FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor - Microsoft Security Blog
CERT-EU
a year ago
εΎŒι–€η¨‹εΌ
CERT-EU
a year ago
Microsoft warns of rising NOBELIUM credential attacks on defense sector
CERT-EU
a year ago
Microsoft just gave you a new way to stay safe from viruses | Digital Trends
DARKReading
a year ago
MagicWeb Mystery Highlights Nobelium Attacker's Sophistication