There’s been an uptick in malware native to Microsoft’s Internet Information Services (IIS) web server that is being used to install backdoors or steal credentials and is hard to detect, warns Microsoft. Microsoft has offered insights into how to spot and remove malicious IIS extensions, which aren’t as popular as web shells as a payload for Exchange servers, but are useful to an attacker as they “mostly reside in the same directories as legitimate modules used by target applications, and they follow the same code structure as clean modules,”

Read full article on ZDNet