{
  "family": "adodb",
  "sample_count": 2,
  "category": "backdoor",
  "description": "Backdoor:Win32/Adodb is a detection specifically targeting malicious web shells or server-side scripts that heavily abuse Microsoft's ActiveX Data Objects (ADO) technology. Rather than infecting standard user workstations, Adodb targets Windows-based web servers (like IIS running ASP or ASP.NET). It provides attackers with a persistent, stealthy backdoor (`T1505.003`) to execute arbitrary commands, query backend databases, and maintain control over the compromised server architecture.<br><br><b>Understanding Adodb (Web Shells)</b><br>To a website visitor, the compromised server appears to function normally. To a security administrator, an Adodb detection represents a critical server breach. The attacker has successfully bypassed perimeter defenses, uploaded a malicious script, and now has interactive access to the web server's underlying operating system and databases.<br><br><b>Execution and Exploitation Mechanics</b><br>Attackers typically deploy Adodb web shells by exploiting vulnerabilities in web applications (e.g., SQL injection, insecure file uploads - `T1190`), or by utilizing stolen server credentials. Once the malicious `.asp` or `.aspx` file is dropped into a web-accessible directory, the attacker accesses it via a standard web browser. The script utilizes the `ADODB.Stream` or `ADODB.Connection` objects. These legitimate COM objects are weaponized by the script to read/write binary files directly to the server's disk (allowing further malware uploads) or to execute raw SQL queries against connected databases, bypassing application-layer security controls.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total compromise of the web server, leading to data exfiltration (database dumping), defacement, or lateral movement into the internal network. Host-based IoCs include the presence of unexpected `.asp` or `.aspx` files in web directories, especially those containing obfuscated VBScript or references to `ADODB.Stream`. EDR telemetry may show the web server process (e.g., `w3wp.exe`) unexpectedly spawning `cmd.exe` or making unusual network connections. Network IoCs include anomalous HTTP POST requests directed at specific, previously unseen scripts on the server.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1505.003",
    "T1190",
    "T1059.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1505.003",
      "name": "Server Software Component: Web Shell (The core backdoor mechanism)",
      "tactic": "Persistence"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (The typical initial infection vector)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately take the compromised web server offline or isolate it from the internal network to prevent lateral movement and database exfiltration.",
    "Locate and quarantine the specific `.asp` or `.aspx` web shell script identified by the alert.",
    "Conduct a comprehensive forensic review of the IIS/Apache access logs to determine how the shell was uploaded and what commands the attacker executed.",
    "Audit all backend databases connected to the web server for unauthorized access or data exfiltration."
  ],
  "what_to_avoid": [
    "Do not simply delete the web shell and bring the server back online; you must identify and patch the vulnerability that allowed the upload in the first place.",
    "Avoid trusting the integrity of any application code or configuration files on the compromised server; they may have been modified via the shell."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}