How Lazarus Group Abuses IIS Servers to Spread Malware? How Should You Protect Your IIS Servers from DLL side-loading Attacks?

Attackers are always searching for weak points to establish a foothold within your network. Today, we are uncovering one such group of attackers who have been observed exploiting Windows IIS servers to distribute malware. We’re referring to the Lazarus group, a notorious cyber assault organization known for its relentless attacks. They have now shifted their focus towards exploiting vulnerable Microsoft Internet Information Services (IIS) servers. Recently, the AhnLab Security Emergency Response Center (ASEC) published a report explaining how the Lazarus group abuses IIS servers to propagate malware. We’ve created this post to let security and Windows teams know about how to protect IIS servers from DLL Side-Loading Attacks.

A Short Introduction to Lazarus Group:

Lazarus group is one of the notorious North Korean-backed APT groups performing multiple attacks worldwide. Many analysts speculate that the Lazarus group, driven by financial motives, contributes to funding North Korea’s weapons development programs while also engaging in various espionage operations.

The Lazarus group gained global attention due to its involvement in various high-profile cyberattacks targeting financial institutions, cryptocurrency exchanges, government agencies, and other organizations. The group is known for its advanced hacking techniques, including spear-phishing, malware deployment, and network intrusion tactics. Lazarus has been linked to numerous significant cyber incidents, such as the 2014 Sony Pictures hack, the 2016 Bangladesh Bank heist, and the WannaCry ransomware attack in 2017.

What is a DLL Side-Loading Attack?

DLL Side-Loading, also known as binary planting, is a type of cyber attack that exploits the way some Windows applications search for Dynamic Link Libraries (DLLs). DLLs are files that contain code and data that multiple programs can use simultaneously on a Windows system.

When a program needs to use a DLL, it will look for it in a specific search order. This usually starts in the directory from which the application is loaded. If a malicious DLL is placed in this directory and has the same name as the DLL the application is looking for, the application may load the malicious DLL instead of the legitimate one. This is the basis of DLL side-loading.

Once the malicious DLL is loaded, it can execute harmful code in the context of the application, potentially leading to the compromise of the system. This type of attack is often used as a way to maintain persistence on a compromised system, or to bypass security measures, as the malicious code is run under the guise of a legitimate process.

How Lazarus Group Abuses IIS Servers to Spread Malware?

As per the report released by AhnLab Security Emergency Response Center (ASEC), Lazarus group is now targeting vulnerable and misconfigured versions of Windows Internet Information Services (IIS) web servers as entry points by the DLL side loading method. Windows IIS servers host web content for organizations, including sites, apps, and services like Microsoft Exchange’s Outlook on the Web. It’s a flexible solution available since Windows NT supports HTTP, HTTPS, FTP, FTPS, SMTP, and NNTP protocols.

DLL side loading is to load malicious DLL in vulnerable software, and when the legitimate program is invoked, the malicious DLL also gets activated; this helps the malware to evade detection by security solutions and maintain persistence.

Technical Analysis

The attacker placed the malicious DLL (msvcr100.dll) in the same directory of the legitimate application (Wordconv.exe) through the Windows IIS web server process, w3wp.exe. Once the malicious DLL is successfully placed, the malicious DLL will also get executed along with the normal execution of the application. This method is known as the DLL side-loading attack.

Fig 1: Logs a Windows IIS web server exploited by Lazarus Group (Source: AhnLab Security)

DLL side-loading technique is one of the key methods in how Lazarus group targets their victims.