Nobelium, the threat actor behind the SolarWinds supply chain attack in December 2020, has recently been linked by Microsoft to a “highly targeted” post-compromise malware dubbed “MagicWeb”. Nobelium overlaps with the Russian nation-state group APT29 (aka CozyBear or The Dukes) and is “highly active, executing multiple campaigns in parallel targeting government organizations, non-government organizations (NGOs), intergovernmental organizations (IGOs), and think tanks across the US, Europe, and Central Asia.” MagicWeb has been observed by Microsoft researchers having similarities with “FoggyWeb”, another malware previously used by Nobelium, and has the main focus of maintaining access and preventing eviction during remediation efforts by the victim. The group must first, however, obtain “highly privileged access to an environment and [move] laterally to an AD FS server.” This advancement must be completed due to MagicWeb being a rogue dynamic linked library (DLL), “a backdoored version of “Microsoft.IdentityServer.Diagnostics.dll”, that leads to stealthy access of an AD FS system through an authentication bypass process. Researchers noted that by Nobelium having highly privileged access, it allows the group to “perform whatever malicious activities they wanted to on the systems they had access to”, such as conduct further system compromises, activity obfuscation, or establish persistence. A further in-depth analysis of MagicWeb can be viewed in Microsoft’s report linked below.