<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
    xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:atom="http://www.w3.org/2005/Atom">
    <channel>
        <title>malware — LowEndSpirit</title>
        <link>https://staging.lowendspirit.com/index.php?p=/</link>
        <pubDate>Mon, 06 Apr 2026 11:59:45 +0000</pubDate>
        <language>en</language>
            <description>malware — LowEndSpirit</description>
    <atom:link href="https://staging.lowendspirit.com/index.php?p=/discussions/tagged/malware/feed.rss" rel="self" type="application/rss+xml"/>
    <item>
        <title>‘Frebniis’ Malware Hijacks Microsoft IIS Function to Deploy Backdoor</title>
        <link>https://staging.lowendspirit.com/index.php?p=/discussion/5514/frebniis-malware-hijacks-microsoft-iis-function-to-deploy-backdoor</link>
        <pubDate>Sun, 19 Feb 2023 18:09:36 +0000</pubDate>
        <category>Industry News</category>
        <dc:creator>AuroraZero</dc:creator>
        <guid isPermaLink="false">5514@/index.php?p=/discussions</guid>
        <description><![CDATA[<p>This is interesting to me anyways.</p>

<p>it seems the malware injects code into a DLL that an IIS feature called Failed Request Event Buffering (FREB) uses when troubleshooting failed requests.</p>

<p><a rel="nofollow" href="https://bwlf.us/WrathfulKhakiPiranha" title="https://bwlf.us/WrathfulKhakiPiranha">‘Frebniis’ Malware Hijacks Microsoft IIS Function to Deploy Backdoor</a></p>
]]>
        </description>
    </item>
   </channel>
</rss>
