IceApple Malware Targets MS Exchange Servers
Security researchers have published a detailed report on a new strain of malware dubbed IceApple. IceApple is described as a post-exploitation framework giving threat actors prolonged under-the-radar access to compromised systems.
A team with infosec firm CrowdStrike examined the threat and believes the malware is linked to a threat actor with links to China, likely one that is state-sponsored as well.
The IceApple framework is a memory-resident tool that can be also run on Internet Information Services (ISS) web server software. The tool has been on the radar of security researchers since 2021, and past attacks observed were in line with the usual targets that China picks for cyber espionage.
The framework is rather large and complex, comprising at least 18 different modules offering different functionality. The modules observed are also being constantly updated, meaning the entire IceApple threat is still in active development.
IceApple has modules that allow for directory listing, writing to and deleting files, making HTTP requests, credential theft, and file exfiltration to remote locations controller by the threat actor.
The in-depth analysis showed that the IceApple framework was developed by people with deep knowledge of the abused underlying systems, including the knowledge of ISS functionality that was never officially documented.
Researchers also noted that attackers exploiting the IceApple framework had the habit of returning to the compromised systems to check for new developments and conduct more data harvesting every couple of weeks.
