MULTI__2018__unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east.pdf

OilRig is observed deploying RGDoor, an IIS-based backdoor, to multiple Middle Eastern targets via the TwoFace webshell; RGDoor operates as a native C++ module loaded into IIS, communicates through a cookie-based payload, and supports commands to execute, upload, and download data, enabling attacker persistence and data exfiltration. The report includes experimental installation steps, screenshots, and discussion of logging considerations and IO behavior, concluding that RGDoor provides a ready-made backdoor for regaining access to compromised servers.