{"id":92066,"date":"2021-12-22T10:49:23","date_gmt":"2021-12-22T10:49:23","guid":{"rendered":"https:\/\/www.stellarinfo.com\/blog\/?p=92066"},"modified":"2024-08-21T04:13:14","modified_gmt":"2024-08-21T04:13:14","slug":"hackers-steal-exchange-server-credentials-owowa-malware","status":"publish","type":"post","link":"https:\/\/www.stellarinfo.com\/blog\/hackers-steal-exchange-server-credentials-owowa-malware\/","title":{"rendered":"Hackers Stealing Exchange Server Credentials Using Malicious IIS Server Module"},"content":{"rendered":"

Security researchers at Kaspersky have discovered a new malicious IIS module called Owowa that harvests user credentials when they login to Outlook Web Access (OWA). The stealthy malware lingers on the IIS server to steal credentials when the user authentication request is made via OWA.<\/p>

Researchers at Kaspersky have identified clusters of Microsoft Exchange Servers targeted by the malware in Asia—mainly in Malaysia, Indonesia, the Philippines, and Mongolia. Most of these servers belong to government organizations.<\/p>

Besides harvesting user credentials, the malware allows hackers to control the server and run malicious commands remotely.<\/p>

How Attackers are Using Owowa Malware to Steal Credentials?<\/h2>

Internet Information Services<\/strong> or IIS<\/strong> is a flexible Microsoft web server suite used to serve files and HTML pages. One can extend the IIS functionalities or add features by installing various add-ons called modules—similar to plugins in WordPress or add-ins in Outlook.  <\/p>

Hackers are taking advantage of this and side loading the malicious Owowa<\/strong> module into the IIS server that infects the Exchange Server and exposes the OWA functions.<\/p>

According to Kaspersky, the attack begins with compromising the unpatched Exchange Server by exploiting the ProxyLogon or ProxyShell vulnerabilities—already patched by Microsoft in March, April, and May 2021.<\/p>

Attackers then sideload the Owowa module into the IIS web server, which exposes the Outlook Web Access (OWA). As per Kaspersky, the malicious module is first registered in the global assembly cache and loaded by the IIS server running the OWA application.<\/p>

Once installed, a malicious actor can interact with the loaded Owowa module by executing specifically crafted commands—mentioned below—within the OWA’s Username<\/em> and Password<\/em> fields on the authentication page of the compromised Exchange Server.<\/p>

\"outlook<\/figure>

According to Kaspersky,<\/p>