Attackers Downgrade WDigest Protection to Dump Plaintext Credentials With Mimikatz

An incident that began with innocuous enumeration commands but quickly escalated into a focused, multi-stage effort to impair detection and extract credentials.

The intruder uploaded a steganographic webshell to an IIS server, used the process w3wp.exe to run OS reconnaissance such as whoami, and then deployed an extensive defence-impairment script (i.bat) that prefaced a credential-dump with Mimikatz-style tooling.

Initial forensics showed likely exploitation of Adobe ColdFusion endpoints historically targeted by attackers (see CVE-2023-26360, CVE-2023-29298 and CVE-2023-29300), although insufficient logging prevented a definitive access vector.

The first webshell, hidden inside an image in wwwroot\Images, used hex-encoded markers ONEPIECE and x_best_911 as operational callbacks.

After the SOC removed the shell and issued remediation steps, the server was returned to production before complete patching; the adversary leveraged that window to return on June 10 and 11 with escalated tactics.

Upon closer inspection of the file, we found that the threat actor had used steganography to hide a webshell called UA4fp7R.aspx within an image.

The recovered i.bat contained a rapid-fire sequence to sabotage telemetry and defenses. It disabled IIS HTTP logging, manipulated Microsoft Defender access via Set-MpPreference and a RemoveDefender PowerShell routine, and added Defender exclusions through WMIC.

The actor forcibly terminated and deleted logging agents and security services Sysmon, Filebeat, Cortex, Dr.Web components, Sentinel services using taskkill, sc.exe, and wmic service calls.

According to Huntress investigation , the attack initially showed a few defence impairment techniques, like steganography and timestomping.

They also abused Image File Execution Options to attach ntvdm/ntsd debuggers to processes such as sysmon.exe and filebeat.exe, effectively freezing them and stopping event capture.

Reconnaissance extended to the registry and local software enumeration. The actor queried HKEY_LOCAL_MACHINE and inspected installed software like FileZilla, likely preparing for data exfiltration ‘living off the land’ .

They leveraged net1.exe to enumerate administrator groups in various languages, suggesting intent to target Western and European environments while evading detections tuned only to net.exe.

On June 11 and re-upload the webshell, but this time before executing a number of enumeration commands, they used timestomped MAC metadata to prevent investigators from determining when the webshell appeared on the system.

Critically, the attacker weakened Windows credential protections. They imported a WDigest.reg and set HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential to 1, forcing Windows to keep plaintext credentials in memory.

Concurrently, they altered Defender policy registry keys to disable real-time and behavior monitoring. The actor exported ODBC registry entries to harvest stored plaintext database credentials and executed custom utilities (g.com, hs.com, dump.com) to write pass.txt and hash.txt, then removed the Mimikatz kernel driver mimidrv.sys after use.

IIS-specific actions further reduced host defenses: appcmd.exe listed sites and virtual directories and the attacker uninstalled the ModSecurity IIS module, eliminating a web application firewall that would block common injection attacks.

These steps reduced detection surfaces and increased the chance of continued, unnoticed access.

This incident underscores two recurring incident-response lessons: attackers chain multiple defence-impairment techniques to blind defenders, and premature restoration of systems before verified remediation creates opportunities for re-compromise.

Defenders should ensure comprehensive, correctly configured logging, immutable collection of telemetry (remote log aggregation), and robust patch management.

Monitoring for indicators such as steganographic webshell fingerprints, registry changes to WDigest, abnormal Defender policy modifications, and IFEO debugger entries can shorten detection dwell time.

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

A wide-reaching campaign in which attackers abused the legitimate remote administration tool ScreenConnect to deploy…

A sophisticated phishing campaign that uses a fake invoice PDF to mask the delivery of…

Around 950 internet-facing Oracle E-Business Suite (EBS) instances have been identified as exposed following enhanced…

A fully featured phishing-as-a-service (PhaaS) panel named “ARToken” that closely mirrors the EvilTokens infrastructure first…

The Cybersecurity and Infrastructure Security Agency (CISA) has recently added a newly discovered vulnerability in…

A targeted phishing campaign delivering the Ousaban banking Trojan to users in Spain and Portugal,…