Microsoft DART Finds Web Shell Threat on the Rise
Various APT groups are successfully using Web shell attacks on a more frequent basis.
An investigation into the breach of a customer’s Web server by Microsoft’s Detection and Response Team (DART) found a Web shell attack that had succeeded in moving through most of the ATT&CK matrix before being remediated.
The Web shell was part of an attack that placed files in numerous directories on the Web server, gaining persistence and beginning to spread laterally in the infrastructure before it was discovered, DART notes. DART also says it is seeing Web shells used more frequently by APT groups, including Zinc, Krypton, and Gallium. And the threat is growing: “Every month, Microsoft Defender Advanced Threat Protection (ATP) detects an average of 77,000 web shell and related artifacts on an average of 46,000 distinct machines,” DART says.
Read more here.
Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
More Insights
Read More HERE