Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Nov 30, 2021 | Updated Dec 08, 2021

Backdoor:Win32/Leeson!MSR

Detected by Microsoft Defender Antivirus

Aliases: No associated aliases

Summary

Microsoft Defender Antivirus detects and removes this threat.

This threat is one of the malware families utilized by NICKEL for command-and-control (C2). It typically use the Internet Explorer (IE) COM interface to connect and receive commands from hardcoded C2 servers.

NICKEL is a nation-state threat actor targeting governments, diplomatic entities, and non-governmental organizations (NGOs) across Central and South America, the Caribbean, Europe, and North America. Read the following blog for details:

To help reduce the impact of this threat, you can:   

  • Contact your incident response team and start the incident response process. If you don't have one, contact Microsoft support for investigation and remediation services.
  • Immediately isolate the affected device. If malicious code has been launched, it is likely that the device is under complete attacker control.
  • Identify the accounts that have been used on the affected device and consider these accounts compromised. Reset passwords or decommission the accounts.
  • Investigate the device timeline for indications of lateral movement activities using one of the compromised accounts. Check for additional tools that attackers might have dropped to enable credential access, lateral movement, and other attack activities.
  • Scope the incident. Find related devices, network addresses, and files in the incident graph.
  • Contain and mitigate the breach. Stop suspicious processes, isolate affected devices, decommission compromised accounts or reset passwords, block IP addresses and URLs, and install security updates.

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

Follow us