Threat Actor Uses Steganographic Webshell and Mimikatz After Disabling Endpoint Defenses

A recent incident response investigation has exposed a sophisticated attack chain in which threat actors used steganographic webshells and extensive defense-evasion techniques to compromise a web server.

The attack underscores the critical importance of comprehensive remediation, as the attackers repeatedly exploited incomplete server restorations to deepen their foothold and cripple the operating system.

The threat actors initially gained access to the target environment in early June, likely exploiting known Adobe ColdFusion vulnerabilities.

Evidence points toward the exploitation of a critical remote code execution vulnerability (CVE-2023-26360), an improper access control bug (CVE-2023-29298), and a deserialization flaw (CVE-2023-29300).

Following the initial breach, the attackers deployed a steganographic webshell named UA4fp7R.aspx. They cleverly hid this malicious payload within an image file stored in the server’s public directory.

Stealth Webshell Mimikatz Attack

Security teams initially detected the intrusion when an IIS worker process, which normally handles legitimate web requests, unexpectedly spawned an operating system enumeration command.

Upon analyzing the hidden webshell, investigators found that it communicated using hexadecimal-encoded strings.

When the payload received a command, it returned the decoded string “ONEPIECE” and acknowledged execution with “x_best_911” to confirm operational status.

Although security personnel quickly deleted the webshell and provided remediation steps, the victim organization prematurely reconnected the server to the internet before fully patching the vulnerabilities.

This oversight allowed the attackers to return days later. During these subsequent intrusions, the threat actors employed MAC timestomping to alter file metadata.

By intentionally corrupting the forensic timeline, they successfully disguised when the new webshells were uploaded to the system.

Huntress said, the attackers launched a massive defense impairment campaign using a batch script dropped into the ProgramData directory.

They systematically compromised security monitoring by turning off IIS logging and executing multiple PowerShell commands to turn off Microsoft Defender’s real-time protection, script scanning, and sample submission capabilities.

The threat actors further neutralized endpoint visibility by aggressively terminating and deleting services for prominent security tools, including Sysmon, Filebeat, Sentinel, and Cortex.

They also used Image File Execution Options (IFEO) to force logging tools to launch under a debugger, effectively freezing the processes and preventing further activity recording.

To bypass basic detection rules, they used the alternative net1.exe command instead of the standard net.exe to enumerate local administrator groups across various European languages.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.