Creepy backdoor found in NetSarang server management software
Researchers at Kaspersky Lab have found a well-hidden backdoor in NetSang's server management software.
The secret access route, dubbed Shadowpad by its discoverers, lurks in the nssock2.dll library within NetSarang's Xmanager and Xshell software suites. It pings out every eight hours to a command-and-control server with the identity of the compromised computer, its network details, and user names.
The backdoor is activated as follows: the .DLL generates a domain name based on the month and year, and performs a DNS lookup on it. A specially crafted DNS TXT record for the domain triggers the opening of a channel to the control server, a decryption key is downloaded by the software, and its next stage is decrypted. This section provides a full backdoor for an attacker to run code and exfiltrate data.
