GhostContainer Discovered: Kaspersky Identifies a New Backdoor Targeting Microsoft Exchange Servers - Lanka Business News

GhostContainer discovered: Kaspersky identifies a new backdoor targeting Microsoft Exchange servers - Lanka Business News

Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered a new backdoor based on open-source tools, dubbed GhostContainer. The previously unknown highly customized malware was discovered during an incident response (IR) case, targeting Exchange infrastructure within government environments. The malware may be part of an advanced persistent threat (APT) campaign targeting high-value entities in Asia, including high-tech companies.    …

GhostContainer backdoor for Exchange servers

In a recent incident response (IR) case, we discovered highly customized malware targeting Exchange infrastructure within government environments. Analysis of detection logs and clues within the sample suggests that the Exchange server was likely compromised via a known N-day vulnerability. Our in-depth analysis of the malware revealed a sophisticated, multi-functional backdoor that can be dynamically extended with arbitrary functionality throug…