Lazarus Group Targeting Windows IIS Web Servers

AhnLab Security Emergency response Center (ASEC) has recently confirmed the Lazarus group, a group known to receive support on a national scale, carrying out attacks against Windows IIS web servers. Ordinarily, when threat actors perform a scan and find a web server with a vulnerable version, they use the vulnerability suitable for the version to install a web shell or execute malicious commands. The AhnLab Smart Defense (ASD) log displayed below in Figure 1 shows that Windows server systems are …

ahnlab asec attacks center emergency find iis lazarus lazarus group malware analysis national response scale scan security server servers support targeting threat threat actors version vulnerability vulnerable web web server windows