S0072 OwaAuth

malwareEnterprise

platformsWindows

also known asOwaAuth

OwaAuth is a Web shell and credential stealer deployed to Microsoft Exchange servers that appears to be exclusively used by Threat Group-3390.

01

techniques used (8)

ATT&CK techniques this enables or maps to.

02

source

Where this definition is published.

view on ATT&CK
scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan