FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.^[1]

FoggyWeb can invoke theCommon.Compress method to compress data with the C# GZipStream compression class.^[1]

FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also,FoggyWeb can encode C2 command output within a legitimate WebP file.^[1]

FoggyWeb can retrieve configuration data from a compromised AD FS server.^[1]

FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.^[1]

FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.^[1]

FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.^[1]

FoggyWeb's loader can check for theFoggyWeb backdoor .pri file on a compromised AD FS server.^[1]

FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimateversion.dll during theMicrosoft.IdentityServer.ServiceHost.exe execution process.^[1]

FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.^[1]

FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.^[1]

FoggyWeb can be disguised as a Visual Studio file such asWindows.Data.TimeZones.zh-PH.pri to evade detection. Also,FoggyWeb's loader can mimic a genuinedll file that carries out the same import functions as the legitimate Windowsversion.dll file.^[1]

FoggyWeb's loader can use API functions to load theFoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.^[1]

FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.^[1]

FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.^[1]

FoggyWeb has been XOR-encoded.^[1]

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server'sMicrosoft.IdentityServer.ServiceHost.exe process.^[1]

FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.^[1]

FoggyWeb's loader can call theload() function to load theFoggyWeb dll into an Application Domain on a compromised AD FS server.^[1]

FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.^[1]

FoggyWeb can allow abuse of a compromised AD FS server's SAML token.^[1]

^[1]