Huntress Traces Three IIS-Linked Attacks and the Attacker’s Trial-and-Error Tactics

Dec 22, 2025 · Original article ↗

Summary

Huntress analyzed three IIS-linked incidents, using endpoint and Windows logs to trace attempted malware execution, Windows Defender changes, and failed persistence. Similar tactics and infrastructure suggest the incidents may share an actor.

Key points

Huntress connected three incidents through similar tactics, malware naming, operating folders, and IP addresses, suggesting—but not confirming—a common actor.
The incidents began with command execution through IIS web server processes after POST requests to web pages; the researchers said a web application flaw may have enabled access.
In the first incident, Windows Defender blocked an attempted certutil download. The attacker tried other executables, returned after detection and quarantine, and later deployed a renamed GotoHTTP tool.
In the second and third incidents, the attacker added Windows Defender exclusions before deploying malware identified as SparkRAT.
Attempts to establish persistence by creating a Windows service failed in the second and third incidents.
Huntress’s analysis shows the actor changing tactics after earlier setbacks, while also repeating techniques that failed.

Article Details

Attack Vectors: Commands were executed through Microsoft IIS worker process w3wp.exe after POST requests to web application pages; the article suggests flaws in the page code may have been exploited, but does not establish the specific vulnerability.
An attacker attempted to download and run agent.exe using certutil.exe; Windows Defender blocked that command in Incident 1.
In Incidents 2 and 3, PowerShell commands added Windows Defender exclusions before follow-on activity.
The attacker attempted persistence by creating a Windows service named WindowsUpdate to launch dllhost.exe; the service failed to start.
Defensive Notes: Monitor IIS-originated process activity and POST requests, and correlate IIS logs with EDR telemetry and Windows Event Logs.
Alert on unexpected certutil.exe downloads and execution of files from C:\Users\Public.
Monitor unauthorized PowerShell changes to Windows Defender exclusions and investigate new exclusions promptly.
Investigate suspicious service creation and failures, including services configured to launch executables from unusual paths.
The article reports that endpoint isolation and quarantine interrupted attacker activity in Incident 1.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]36[.]25[.]169`	Client IP address in an IIS POST log entry preceding detected activity in Incident 2.
IPV4	`103[.]36[.]25[.]171`	Client IP address associated with the December 8 return in Incident 1 and an active connection before endpoint isolation.
IPV4	`110[.]172[.]104[.]95`	IP address used to host the attempted agent.exe download in Incident 1; the article reports a malware-associated reputation.
IPV4	`188[.]253[.]121[.]101`	Client IP address in an IIS POST log entry preceding detected activity in Incident 3.
IPV4	`188[.]253[.]126[.]202`	Client IP address appearing in web server logs associated with attacker activity in Incidents 1 and 2.
IPV4	`188[.]253[.]126[.]205`	Client IP address in the IIS log entry associated with initial command execution in Incident 1.
SHA256	`272de450450606d3c71a2d97c0fcccf862dfa6c76bca3e68fe2930d9decb33d2`	SHA256 hash of test.exe, identified in the article as ShellcodeRunner.
SHA256	`66a28bd3502b41480f36bd227ff5c2b75e0d41900457e5b46b00602ca2ea88cf`	SHA256 hash associated with agent.exe and dllhost.exe in Incidents 2 and 3; the article identifies the file as SparkRAT.
SHA256	`909460d974261be6cc86bbdfa27bd72ccaa66d5fa9cbae7e60d725df13d7e210`	SHA256 hash of 815.exe, an executable retrieved from the Incident 1 endpoint.