Thought Leadership
An incident investigated by Huntress shows just how thoroughly an attacker can settle into a compromised environment after gaining initial access.
Rather than immediately stealing data or deploying ransomware, the attacker systematically established a foothold in the environment over several hours. The incident, discovered on June 26 at a technology company, began with an alert related to a Microsoft SQL Server process. The subsequent investigation revealed that the attacker had not directly targeted the database. Instead, they found a website on the same server that failed to properly validate user input, leaving a classic SQL injection vulnerability exposed. The attacker exploited the flaw to gain access to the underlying Windows machine, which also hosted the IIS web server.
From there, the attacker initially used Base64-encoded PowerShell commands to download additional scripts from an externally hosted Cloudflare R2 storage location, including a file with the conspicuous name qdcjoke1.2.ps1. The attacker then used the tasklist /svc command to conduct basic reconnaissance of the services running on the system and sent the results via PowerShell to an address under their control, presumably for later analysis or processing by automated tools.
A New Administrator Account and Disabled Antivirus
The attacker then established persistent access to the system. They enabled the previously disabled Remote Desktop service, created a new user account named adminweb2$, and added it to the local Administrators group. The attacker subsequently used the account to connect to the system via Remote Desktop, providing access that would survive a reboot or superficial cleanup.
The attacker also disabled Windows Defender, Microsoft’s built-in antivirus protection. Notably, however, they left other security tools installed on the system, including an EDR solution, untouched. This suggests that the attacker either was unaware of those tools or was unable to disable them.
Turning the Web Server Into a Weapon Against Other Websites
The attacker then used the appcmd.exe command-line utility to install two known IIS web server extensions, HttpFastCgiModule.dll and HttpCgiModule.dll. These components belong to the BadIIS malware family, which security researchers at Cisco Talos have found being used for roughly 18 months in various large-scale search engine manipulation campaigns.
Through capabilities such as traffic redirection, hidden link injection and reverse proxy functionality, BadIIS can turn a compromised web server into a tool for manipulating search results and advertising traffic belonging to other websites, without the legitimate site operator being aware of the activity.
Cryptocurrency Miner Uses Multiple Layers of Obfuscation
Next, the attacker downloaded the well-known XMRig cryptocurrency miner to the system as a file named xmr-1.zip. To conceal the associated files, they used the Windows attrib.exe command to mark two files, edge.exe and Taskgmr.ps1, as System, Hidden and Read-only.
The files were placed in the Microsoft Edge updater directory, where they would be unlikely to attract attention during a superficial inspection. To ensure persistence, the attacker used the freely available nssm.exe utility to create a dedicated Windows service for the miner, allowing it to survive system restarts. They also installed the CnCrypt Protect tool, apparently to further conceal the activity from security software.
An Unusually Large Number of Changes on a Single System
Throughout the attack, the threat actor also relied on PowerShell commands designed to run without a visible window, without security prompts and while bypassing script execution policies. This included silently launching batch files such as qd_tjoke.bat.
Huntress emphasizes that none of these techniques is particularly unusual on its own. What stood out in this incident was the sheer number of changes the attacker made to a single system, ranging from creating a new account and disabling antivirus protection to installing three different types of malware.
Why Closing the Initial Entry Point Still Matters
According to Huntress, the incident highlights a critical lesson: removing obvious malware is not enough if the underlying cause of the breach remains undiscovered.
Had the security team in this case simply removed the newly created account and installed malware without fixing the underlying SQL injection vulnerability in the web application, the attacker could have regained access through the same open path at any time, potentially using modified and more difficult-to-detect techniques.
Huntress therefore recommends that organizations maintain a complete and up-to-date inventory of all physical and virtual systems, along with the applications deployed on them and their respective versions. Building on that foundation, the company advises organizations to deliberately reduce their attack surface, remove unnecessary or unauthorized applications, restrict access to authorized users and consistently enforce multi-factor authentication.
Organizations should also patch all active applications regularly and include them in continuous monitoring. Finally, every detected incident should be investigated to identify its root cause rather than focusing solely on removing the visible malware.
(Huntress/Editorial Team)
