A recent investigation by Huntress Labs has shed light on what happens after an attacker gains access to a compromised system. Instead of immediately carrying out malicious activities like data theft or ransomware deployment, attackers often take time to “dwell” and establish a foothold within the network.
In a particularly telling incident from June, an attacker took advantage of a vulnerable Microsoft SQL Server process on a web server to gain initial access. What’s striking is that this attacker didn’t immediately rush into destructive behavior like stealing data or encrypting files. Instead, they carefully modified the environment to cover their tracks and create backdoors for future use.
The attacker started by exploiting a classic SQL injection vulnerability in a webpage on the same server as the SQL Server process. This allowed them to access the underlying Windows machine. It’s worth noting that SQL injection remains one of the most common web application vulnerabilities, and it can be easily prevented by properly sanitizing user input.
Once inside, the attacker took time to “case the joint,” gathering information about which services were running on the machine. They ran a built-in Windows command called “netstat” to list active network connections and then sent the results to their own server for review or automated analysis. This step is crucial in understanding what resources are available for further exploitation.
The attacker’s next move was to make themselves at home within the environment. They enabled Remote Desktop access, created a new user account with high-level privileges, and added it to the local Administrators group. This granted them instant access to sensitive areas of the system that would survive even a basic cleanup or reboot. Notably, they left other security monitoring tools like Endpoint Detection and Response (EDR) untouched, suggesting either ignorance or a deliberate choice.
The attacker also installed malicious add-ons for the Internet Information Services (IIS) web server software running on the machine. These add-ons were part of a known malware family called BadIIS, used to hijack legitimate website traffic for search-engine fraud and other illicit activities. This essentially turned the compromised web server into a tool for manipulating search rankings and ad traffic without the owner’s knowledge.
Furthermore, the attacker dropped a cryptocurrency mining program onto the machine, using its processing power to generate cryptocurrency at the victim’s expense. To keep this activity hidden, they disguised the miner’s files as system files and set it up to run as a Windows service, ensuring it would start automatically even after a reboot.
The investigation highlights the importance of not only preventing initial breaches but also understanding what happens once an attacker is inside. It emphasizes the need for vigilant monitoring and prompt response in post-breach situations. For security professionals, this serves as a reminder that dwell time can be a crucial factor in determining the extent of damage inflicted by attackers.
For everyday users and organizations, it’s essential to prioritize proper vulnerability management, maintain up-to-date software, and stay informed about emerging threats. By doing so, you’ll not only prevent initial breaches but also minimize the potential for attackers to establish themselves within your network. Regular security audits, monitoring tools, and employee education can go a long way in preventing such incidents from unfolding.
Source: Bleeping Computer — 2026-07-30