Stealthy C2 via Failed Request Event Buffering (FREB)

Symantec published an article on the Frebniis malware. The new technique involves injecting malicious code into the memory of a DLL file (iisfreb.dll) related to an IIS feature used to troubleshoot and analyze failed web page requests. The Frebniis malicious injected code parses all received HTTP POST requests for /logon.aspx or /default.aspx along with a parameter password set to ‘7ux4398!’. If the password matches, Frebniis decrypts and executes a section of the injected code, which is .NET executable code consisting of the main backdoor functionality. No executables are saved to disk in this process, keeping the backdoor completely stealthy. Microsoft described malicious IIS modules as a hard-to-spot persistence trick in July 2022, but its hunting advice (inspect web.config, the GAC and modules added via appcmd) would likely come up empty here, because Frebniis registers no module and only patches the IIS worker process in memory.