Threat Actor Uses Steganographic Webshell and Defence Impairment Before Mimikatz Execution

Threat actors are increasingly combining stealthy initial access techniques with aggressive defense impairment to bypass modern security solutions.

In a recent incident beginning on June 7, attackers deployed a steganographic webshell after a likely Adobe ColdFusion exploit.

Before eventually deploying Mimikatz for credential dumping, the attackers executed an extensive array of evasion commands to blind security teams and cripple the victim’s host operating system.

The initial intrusion likely stemmed from unpatched Adobe ColdFusion vulnerabilities.

Historical server logs showed exploitation attempts targeting known endpoints associated with bugs like CVE-2023-26360 (critical remote code execution), CVE-2023-29298 (access control bypass), and CVE-2023-29300 (deserialization).

Steganographic Webshell Mimikatz Execution

This malicious image contained human-readable JavaScript hidden at the very end of the file. It also relied on hex-encoded strings for operational checks.

When decoded, one string translated to “ONEPIECE,” which the shell sent back to the attacker to confirm it had received a command. Another decoded string, “x_best_911,” confirmed that the command was successfully executed.

Defenders initially caught the intrusion by spotting basic enumeration commands, such as whoami, suspiciously spawning from the IIS worker process (w3wp.exe).

Legitimate web applications rarely run operating system reconnaissance commands, making this a clear indicator of a webshell.

While security teams quickly flagged the malicious file for deletion, the victim organization brought the server back online prematurely before fully securing the environment.

This critical misstep allowed the threat actor to return days later with a much more destructive payload.

Upon returning, the attacker immediately focused on covering their tracks. They first used timestomping on the MAC (Modified, Accessed, Created) metadata of newly uploaded webshells.

Falsifying these file timestamps helps malicious files blend into the environment and intentionally corrupts the timeline forensic investigators rely on.

Next, the threat actor deployed a comprehensive batch script (i.bat) to dismantle the server’s defenses systematically. The script began by turning off IIS HTTP logging to prevent future webshell uploads.

It then launched multiple PowerShell commands to completely neutralize Microsoft Defender, turning off real-time monitoring, behavior monitoring, script scanning, and sample submission.

Huntress said, the attacker also aggressively targeted third-party logging and security tools. They terminated and deleted services for Sysmon, Elastic Filebeat, and other endpoint agents.

Furthermore, they abused the Image File Execution Options (IFEO) to force critical logging utilities to launch under a debugger. This tactic effectively froze and neutralized the logging processes.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.