GhostContainer: New vulnerability attacks Microsoft Exchange servers through backdoor malware

Kaspersky's Global Research and Analysis Team (GReAT) has discovered a new backdoor malware called GhostContainer, built on open source tools, a sophisticated malware that has never been discovered before.

According to Kaspersky, it is not yet possible to assign responsibility to any hacker group because the attackers did not show any signs of penetrating any infrastructure.

The GReAT team discovered the malware during incident response operations on government systems that use Microsoft Exchange. GhostContainer is believed to be part of a sophisticated and persistent advanced persistent threat (APT) campaign targeting key organizations in the Asia region, including major technology companies.

The malicious file discovered by Kaspersky, called App_Web_Container_1.dll, is actually a multi-functional backdoor that can be extended by downloading additional modules remotely. The malware takes advantage of many open source projects and is sophisticatedly customized to avoid detection.

Once GhostContainer is successfully installed on a system, hackers can easily take complete control of the Exchange server, from which they can perform a series of dangerous actions without the user knowing. This malware is cleverly disguised as a valid component of the server and uses many surveillance evasion techniques to avoid detection by anti-virus software and bypass security monitoring systems.

In addition, this malware can act as a proxy server or an encrypted tunnel, creating loopholes for hackers to penetrate internal systems or steal sensitive information. Looking at this way of operation, experts suspect that the main purpose of this campaign is likely to be cyber espionage.

“Our in-depth analysis shows that the perpetrators are highly proficient in penetrating Microsoft Exchange server systems. They leverage a variety of open source tools to penetrate IIS and Exchange environments, and develop sophisticated spying tools based on available open source code. We will continue to monitor the group’s activities, as well as the scope and severity of their attacks, to better understand the overall threat picture,” said Sergey Lozhkin, Head of the Global Research and Analysis Team (GReAT) for Asia Pacific and Middle East and Africa at Kaspersky.

GhostContainer uses code from multiple open source projects, making it fully vulnerable to cybercriminal groups or APT campaigns anywhere in the world . Notably, by the end of 2024, a total of 14,000 malware packages were detected in open source projects, up 48% from the end of 2023. This number shows that the level of risk is increasing in the field.

BINH LAM

Source: https://www.sggp.org.vn/ghostcontainer-lo-hong-moi-tan-cong-may-chu-microsoft-exchange-thong-qua-ma-doc-backdoor-post805372.html