Port 22

The SessionManager IIS backdoor: a possibly overlooked GELSEMIUM artefact

In early 2022, we investigated an IIS backdoor called SessionManager. It has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East.