FoggyWeb

FoggyWeb can retrieve configuration data from a compromised AD FS server.

FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.

FoggyWeb has been XOR-encoded.

FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.

FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.

FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.

FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.

FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.

FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.

FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.

FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.

FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.

FoggyWeb can allow abuse of a compromised AD FS server's SAML token.