How To Protect AD FS From The FoggyWeb Backdoor?

Microsoft warned about a new post-exploitation backdoor named FoggyWeb. A backdoor mainly created to gain admin-level access to Active Directory Federation Services (AD FS) servers. We have created this post to let you know how to protect your AD FS servers from the FoggyWeb backdoor.

What Is Active Directory Federation Services (AD FS)?

Active Directory Federation Services (AD FS) makes it possible for local users and federated users to use claims-based single sign-on (SSO) to Web sites and services. You can use AD FS to enable your organization to collaborate securely across Active Directory domains with other external organizations by using identity federation. This reduces the need for duplicate accounts, management of multiple logons, and other credential management issues that can occur when you establish cross-organizational trusts.

By Microsoft

Who Created The FoggyWeb Backdoor Malware?

As per the analysis report shared by Microsoft Threat Intelligence Center (MSTIC), A well-known threat actor, NOBELIUM, is behind the FoggyWeb backdoor. This is the same actor behind the email campaigns like SUNBURST backdoor, TEARDROP malware,GoldMax, GoldFinder, and Sibot malware, 

Why Was FoggyWeb Backdoor Created?

The main purpose of any backdoor is to maintain unauthorized access to the victim machine. NOBELIUM created the FoggyWeb backdoor to perform most likely similar tasks. FoggyWeb backdoor was created to remotely exfiltrate the configuration database of compromised AD FS servers, decrypted token-signing certificate (To digitally sign all security tokens), and token-decryption certificate (To decrypt tokens that are received by the federation server). Go through this report for the full analysis of FoggyWeb backdoor malware.

Indicators Of Compromise (IOCs) Of FoggyWeb Backdoor:

How To Protect AD FS From The FoggyWeb Backdoor?

Precautions are always considered better than cure infections. If you ever suspect that your AD FS servers could be victimized by the FoggyWeb backdoor. Follow these tips to protect AD FS from the FoggyWeb backdoor.

We hope this post would help you in protecting your AD FS from the FoggyWeb backdoor. Thanks for reading this threat post. Please share this post and help to secure the digital world. Please visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.