How To Protect Your IIS Servers From The SessionManager Backdoor

Recently, security engineers from Kaspersky detected a backdoor dubbed SessionManager. As per the report, the malware is created to target Microsoft IIS servers. Once deployed, the malware allows cyber criminals access to company emails and download additional malware to maintain persistent. The worst about the SessionManager backdoor is its poor detection rate. Most popular antivirus scan engines failed to detect most of the SessionManager’s samples. Considering its severity and criticality in the infrastructure, we believe it is important to protect your IIS servers from the SessionManager backdoor.

Let’s see how to protect your IIS servers from the SessionManager backdoor in this post. Before we talk about the protection, let’s see some technical details about the SessionManager backdoor.

About The SessionManager Backdoor:

The SessionManager, which is written in C++, is a malicious native-code IIS module that is created to process legitimate HTTP requests going to the IIS server upon getting loaded by some IIS applications.

Practically, The SessionManager backdoor is difficult to identify with general monitoring techniques because it neither initiates suspicious communication to the external server nor receives commands from the remote servers as HTTP requests. Moreover, its files are placed in a location where legitimate files are placed.

Another reason that makes such backdoors hard to identify, according to Pierre Delcher, a security researcher, “Such malicious modules usually expect seemingly legitimate but specifically crafted HTTP requests from their operators, trigger actions based on the operators’ hidden instructions if any, then transparently pass the request to the server for it to be processed just like any other request.”

Some of the capabilities of the SessionManager Backdoor are:

Considering its technical capabilities, it’s very important to protect your IIS servers from the SessionManager backdoor. To know more about the SessionManager’s technical details with the working mechanism, please visit Securelist.com.

Victimology Of The SessionManager Backdoor:

The backdoor is identified in several countries in Europe, the Middle East, South Asia, and Africa. The malware has compromised one server per organization and one compromised organization per location; however, Vietnam is the main exception as several compromised servers from several organizations could be identified there. It’s been said that there are still 20 organizations running a compromised server till the end of June 2022.

Pic: Picture by Kaspersky

The variant of the SessionManager backdoor is detected on 24 distinct organizations in Argentina, Armenia, China, Djibouti, Equatorial Guinea, Eswatini, Hong Kong, Indonesia, Kenya, Kuwait, Malaysia, Nigeria, Pakistan, Poland, the Russian Federation, Saudi Arabia, Taiwan, Thailand, Turkey, the United Kingdom, and Vietnam.

Cybercriminals are most likely targeted to infect government or military organizations. However, it’s also seen the malware targets international and national non-government organizations, electronic equipment manufacturers, shipbuilding companies, health care and surgery group,  local road transportation companies, state oil companies, state electricity companies, a sales kiosk manufacturer, and an ERP software editor.

How To Protect Your IIS Servers From The SessionManager Backdoor?

Considering the SessionManager’s poor detection rates, there are chances of massive exploitations since March 2021. Practically, it is not an easy task to scan each and every IIS server deeply to identify the backdoor. Despite that, we suggest listing out all the loaded IIS modules in a running server and looking for malicious modules, and removing them to protect your IIS servers from the SessionManager backdoor.

To list the IIS modules on GUI: