LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0661: FoggyWeb

FoggyWeb is a passive and highly-targeted backdoor capable of remotely exfiltrating sensitive information from a compromised Active Directory Federated Services (AD FS) server. It has been used by APT29 since at least early April 2021.[1]

EnterpriseS0661MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

FoggyWeb matters because it is described as a passive, highly targeted backdoor on a compromised AD FS server, with capability to remotely exfiltrate sensitive information. For leaders, the key issue is not just malware removal; AD FS is identity infrastructure, so evidence of this behavior should trigger questions about certificate/private key exposure, alternate authentication material, persistence, and whether identity trust needs to be revalidated.

Executive priority

Prioritize this as an identity-infrastructure resilience scenario. Executives should ask whether AD FS servers are treated as tier-critical assets, whether security teams collect enough host and network evidence to investigate stealthy DLL/module-based activity, and whether incident response plans include decisions for key/certificate protection, authentication material compromise, and controlled restoration of identity services. This object also supports audit and compliance conversations around privileged system monitoring, change control, and evidence retention for identity platforms.

Technical view

The supplied ATT&CK relationships place FoggyWeb across collection, credential access, discovery, execution, command and control, exfiltration, lateral movement, and stealth behaviors. SOC and IR teams should validate coverage on Windows AD FS servers for suspicious DLL/shared module loading, reflective or memory-resident execution, Native API-heavy behavior, compile-after-delivery artifacts, encoded/encrypted files, masqueraded resource names or locations, process/file discovery, private key access, archive creation, web-protocol C2, symmetric encrypted communications, ingress tool transfer, and exfiltration over a C2 channel. Because the malware object itself has no official ATT&CK detection text, detection engineering should be built from the related techniques and local AD FS baselines rather than assumed signatures.

Likely telemetry

  • Windows process creation and parent-child process activity on AD FS servers
  • DLL load, shared module load, and suspicious module path/name telemetry
  • File system events for AD FS-related directories, certificate/private key locations, archives, encoded or encrypted artifacts, and newly delivered tools
  • Compiler or build utility execution evidence where compile-after-delivery is plausible
  • Memory or EDR telemetry for reflective code loading and anomalous in-process execution

Detection direction

  • Start with a tight baseline of normal AD FS server behavior; alerting without baselines may generate noise because web protocols, DLLs, and legitimate modules are common.
  • Correlate stealth indicators together: masqueraded names or locations, unexpected DLL/module loads, encoded files, deobfuscation, reflective loading, and Native API-heavy execution are more meaningful in combination.
  • Treat access to private keys, certificates, token-related material, or AD FS-sensitive files as high-value investigative leads, especially when paired with archive creation or outbound web traffic.
  • Review egress from AD FS servers for unusual destinations, timing, volume, or protocol use; T1071.001, T1041, and T1573.001 imply that normal-looking or encrypted web traffic can hide activity.
  • Validate whether host telemetry can see memory-resident or module-based execution; file-only controls may miss reflective code loading and passive backdoor behavior.

Mitigation priorities

  • Classify AD FS servers as critical identity assets and enforce stronger monitoring, change control, and administrative access restrictions around them.
  • Protect private keys and certificates with strict access control, inventory, rotation procedures, and incident playbooks for suspected exposure.
  • Limit and monitor outbound network paths from AD FS servers so unusual web-protocol communications and exfiltration paths are visible and reviewable.
  • Maintain reliable host logging and EDR-style visibility for process, module, DLL, file, memory, and network activity on Windows identity servers.
  • Harden file and module loading paths, review trusted locations, and monitor for resource-name masquerading or unexpected shared modules.
Additional notes and limits

The strongest decision value is the identity angle: a backdoor on AD FS can affect trust, authentication material, and sensitive identity data. The ATT&CK relationships also indicate stealth and C2 behaviors that are likely to challenge simple perimeter or signature-only monitoring. Use the APT29 relationship as threat-intelligence context supported by MITRE, but do not assume current activity or local exposure without environment evidence.

The supplied object provides no official detection guidance, no aliases, no malware tactics, and no indicators of compromise. Several related technique platform lists are broader than the malware platform; for this take, Windows and AD FS should be treated as the supported focus. Local architecture, logging depth, certificate handling, and AD FS configuration are required to determine actual risk and detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

FoggyWeb

FoggyWeb is a passive and highly-targeted backdoor capable of remotely exfiltrating sensitive information from a compromised Active Directory Federated Services (AD FS) server. It has been used by APT29 since at least early April 2021.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1140Deobfuscate/Decode Files or Information

FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.[1]

EnterpriseT1560.003Archive via Custom MethodSub-technique

FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.[1]

EnterpriseT1041Exfiltration Over C2 Channel

FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.[1]

EnterpriseT1027.004Compile After DeliverySub-technique

FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.[1]

EnterpriseT1005Data from Local System

FoggyWeb can retrieve configuration data from a compromised AD FS server.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

FoggyWeb has been XOR-encoded.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.[1]

EnterpriseT1552.004Private KeysSub-technique

FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.[1]

EnterpriseT1036Masquerading

FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.[1]

EnterpriseT1057Process Discovery

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.[1]

EnterpriseT1550Use Alternate Authentication Material

FoggyWeb can allow abuse of a compromised AD FS server's SAML token.[1]

EnterpriseT1106Native API

FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.[1]

EnterpriseT1129Shared Modules

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.[1]

EnterpriseT1040Network Sniffing

FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.[1]

EnterpriseT1560.002Archive via LibrarySub-technique

FoggyWeb can invoke the `Common.Compress` method to compress data with the C# GZipStream compression class.[1]

EnterpriseT1105Ingress Tool Transfer

FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.[1]

EnterpriseT1574.001DLLSub-technique

FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate `version.dll` during the `Microsoft.IdentityServer.ServiceHost.exe` execution process.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.[1]

EnterpriseT1083File and Directory Discovery

FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.[1]

EnterpriseT1620Reflective Code Loading

FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0016: APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1560.003: Archive via Custom MethodEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1027.004: Compile After DeliveryEnterpriseuses · GroupG0016: APT29Enterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1552.004: Private KeysEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1550: Use Alternate Authentication MaterialEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1129: Shared ModulesEnterpriseuses · TechniqueT1040: Network SniffingEnterpriseuses · TechniqueT1560.002: Archive via LibraryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1620: Reflective Code LoadingEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
229ccb18cb17b9f0...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle229ccb18cb17…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  2. [2]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  3. [3]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  4. [4]
    mitre-attackS0661
    Open source URL
  5. [5]
    mitre-attackS0661
    Open source URL
  6. [6]
    mitre-attackS0661
    Open source URL
  7. [7]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  8. [8]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  9. [9]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  10. [10]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  11. [11]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  12. [12]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  13. [13]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  14. [14]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  15. [15]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  16. [16]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  17. [17]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  18. [18]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  19. [19]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  20. [20]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  21. [21]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  22. [22]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  23. [23]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  24. [24]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  25. [25]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  26. [26]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  27. [27]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  28. [28]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  29. [29]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  30. [30]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  31. [31]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  32. [32]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  33. [33]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  34. [34]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  35. [35]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  36. [36]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  37. [37]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  38. [38]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  39. [39]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  40. [40]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  41. [41]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  42. [42]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  43. [43]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  44. [44]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  45. [45]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  46. [46]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  47. [47]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
  48. [48]
    MSTIC FoggyWeb September 2021

    Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use