Home > List all groups > List all tools > List all groups using tool MagicWeb

Threat Group Cards: A Threat Actor Encyclopedia

Names	MagicWeb
Category	Malware
Type	Backdoor
Description	(Microsoft) MagicWeb goes beyond the collection capabilities of FoggyWeb by facilitating covert access directly. MagicWeb is a malicious DLL that allows manipulation of the claims passed in tokens generated by an Active Directory Federated Services (AD FS) server. It manipulates the user authentication certificates used for authentication, not the signing certificates used in attacks like Golden SAML.
Information	<https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/>

Last change to this tool card: 12 September 2022

Download this tool card in JSON format

1 group listed (1 APT, 0 other, 0 unknown)

APT groups