FoggyWeb

FoggyWeb is a type of malware recently discovered by Microsoft that hackers are using to remotely steal network admin credentials. The malware, which has been in use since as early as April 2021, is employed by the hacker group NOBELIUM to remotely exfiltrate the configuration database of compromised Active Directory Federation Services (AD FS) servers. This includes decrypted token-signing and token-decryption certificates, allowing for the download and execution of additional components. FoggyWeb's operations are facilitated through direct interaction with the AD FS codebase, rather than through an external disk-resident tool. The FoggyWeb malware was built on previous post-exploitation tools such as MagicWeb, first described by Microsoft in August 2022. MagicWeb, like FoggyWeb, could steal certificates from AD FS servers. The malware operates by loading the FoggyWeb DLL into one or more application domains where the legitimate AD FS code is running. After being loaded into the current application domain, the loader invokes a specific method from the DLL: Microsoft.IdentityServer.WebExtension.WebHost. In its operational cycle, FoggyWeb creates a Safe Array and copies the decrypted backdoor bytes to the array. This allows the malware to selectively invoke native AD FS methods needed to facilitate its malicious operations. The use of FoggyWeb poses significant risks to network security due to its ability to steal network admin credentials and interact directly with server codebases, highlighting the need for robust cybersecurity measures to prevent such exploits.