New DCOM Attack Exploits Windows Installer for Backdoor Access

Attribute	Details
Threat Actors	Not specified
Campaign Overview	Novel DCOM-based lateral movement attack for stealthily deploying backdoors on Windows systems
Target Regions (Or Victims)	Limited to organizations within the same domain
Methodology	Exploits Windows Installer service, IMsiServer interface, malicious DLLs, remote code execution
Product Targeted	Windows Installer service, COM interfaces
Malware Reference	Malicious DLLs crafted remotely and loaded into services
Tools Used	Custom DLLs, IMsiServer COM interface, DCOM exploitation methods
Vulnerabilities Exploited	IMsiServer interface, Windows Installer service vulnerabilities
TTPs (Tactics, Techniques, Procedures)	Remote code execution, lateral movement, DLL writing and execution, interface manipulation
Attribution	Deep Instinct (researchers), no specific threat actor mentioned
Recommendations	Apply consistent DCOM hardening patches, ensure strongly named .NET assembly compatibility
Source	Hackread

Read full article: https://hackread.com/dcom-attack-exploits-windows-installer-backdoor-access/

The above summary has been generated by an AI language model