Q3 2026 Statistical Report on Malware Targeting Windows Web Servers
Content
The AhnLab SEcurity intelligence Center (ASEC) analyzed the attack status of Windows web servers in the third quarter of 2026 based on AhnLab Smart Defense (ASD) logs. The targets were Internet Information Services (IIS) web servers and Apache Tomcat web servers running in Windows environments, with attacks primarily exploiting unpatched vulnerabilities, misconfigurations, and inadequate management environments. Threat actors gained control of the servers by uploading web shells, exploiting remote code execution vulnerabilities, using proxy tools, and employing privilege escalation tools.
Purpose and Scope
This report summarizes the damage status and attack statistics for Windows web servers based on logs identified in the third quarter of 2026. It also performs classification of the malware used in attacks and covers web shell types along with actual attack cases. Web shells were excluded from the statistical classification but were summarized separately, focusing only on the major types.
Attack Cases
- Telerik UI for ASP.NET AJAX is a UI component product used for developing Microsoft ASP.NET-based web applications. CVE-2019-18935 is a .NET deserialization vulnerability in RadAsyncUpload; when exploited, it allows remote code execution with the privileges of the w3wp.Exe process on an IIS web server. This report summarizes two attack cases observed in Korea and outlines countermeasures.
- In the first case, after exploiting the vulnerability, the attacker executed a reverse shell and used the
hostname.Execommand to retrieve the system name, privileges, and running processes. Subsequently, an attempt to perform privilege escalation using Potato-family tools was detected, and ultimately, a Godzilla-style web shell was installed. - The reverse shell created a Windows socket and attempted a TCP connection to port 80 on 206[.]82.6.22; Through this connection, the threat actor could send commands remotely and receive the results. Several modified Potato-family privilege escalation tools, including SweetPotato, were also detected on the infected systems; these tools were able to obtain SYSTEM privileges using token spoofing techniques such as PrintSpoofer.
- The web shell operated by injecting a memory-based web shell into a Telerik-based ASP.NET environment. Once the payload DLL was loaded, it scanned the environment where Telerik.Web.UI was running, loaded godmemshell.Dll into memory, and registered a malicious request-handling function with ASP.NET’s VirtualPathProvider. The installed web shell used the “Godzilla” method, which receives and executes a .NET payload via HTTP requests.
- In the second case, CVE-2019-18935 was exploited to create and execute a scanner file on the target system. In this case, neither a reverse shell nor a web shell was used, and only the command to execute the scanner was identified in the vulnerability exploitation payload.
- The scanner was a Rust-based tool that received a list of targets from a remote server and then asynchronously crawled URLs leading to WordPress installation and configuration pages. Once it determined that a server had WordPress installed, it sent the URL and public IP address to Telegram in an attachment named “red.Txt.” The scanning criteria involved checking 53 candidate paths to determine whether they contained /wp-admin/setup-config.Php or /wp-admin/install.Php.
Conclusion
Windows web servers are often exposed to the public, making them targets for various threat actors and malware. After gaining initial control through a web shell, threat actors proceeded with follow-up activities such as privilege escalation, proxy exploitation, remote control, cryptocurrency mining, and turning the server into a VPN. The report concluded that necessary countermeasures include patching web frameworks, services, and platforms to the latest version; reducing external exposure through measures such as firewalls; and keeping V3 up to date.
