Answer Brief
AhnLab ASEC published an analysis detailing how attackers exploit the Suo5 HTTP and HTTPS tunneling tool for network pivoting and lateral movement. The report documents real-world file deployment on Windows IIS web servers and fileless memory injection within Java-based Jenkins environments, outlining specific execution artifacts and defensive recommendations.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
AhnLab ASEC publishes technical case studies analyzing Suo5-based tunneling and pivoting techniques.
Executive Summary: AhnLab ASEC published an analysis detailing how attackers exploit the Suo5 HTTP and HTTPS tunneling tool for network pivoting and lateral movement. The report documents real-world file deployment on Windows IIS web servers and fileless memory injection within Java-based Jenkins environments, outlining specific execution artifacts and defensive recommendations.
Why It Matters
Security research team ASEC at AhnLab has released a technical breakdown documenting how threat actors deploy and operate the Suo5 HTTP and HTTPS tunneling tool to execute pivoting inside enterprise networks. Pivoting represents a technique in which attackers use a previously compromised host as an intermediary relay to access other internal systems and expand the overall scope of an intrusion. AhnLab's case studies examine how Suo5 enables lateral movement by routing internal network traffic through compromised, publicly reachable web servers.
The analysis clarifies the operational distinction between tunneling and port forwarding in multi-stage compromises. While port forwarding directs network traffic arriving at a specific host and port onward to another designated destination host or port, tunneling encapsulates one protocol's data inside another protocol for transit. Suo5 utilizes HTTP or HTTPS encapsulation to carry TCP traffic, granting operators SOCKS5 proxy-based access to restricted internal networks while blending with normal web communication streams.
Technical Signal
Technically, Suo5 provides capabilities that make it adaptable across varied web serving environments. The tool supports both full-duplex and half-duplex communication modes and allows operators to customize HTTP request methods, request headers, and User-Agent values. Suo5 is engineered to function within Java, PHP, and Microsoft IIS/.NET architectures, as well as configurations utilizing Nginx reverse proxies as front-end intermediaries.
In the first confirmed incident examined by AhnLab, attackers relied on a direct file-based deployment workflow. By taking advantage of an unmitigated file upload vulnerability on a Windows Server-based IIS web host, the attacker uploaded a Suo5 ASPX component. To disguise the malicious payload, the file was renamed from Suo5.Aspx to FilesImages.Aspx. Once executed, the file established an active communication conduit that allowed the attacker to reach additional internal targets.
Operational Impact
Forensic traces generated during the file-based attack method centered on web server logs and dynamic .NET compilation artifacts. Inspection of IIS web server access records revealed repeated POST requests sent directly to the disguised FilesImages.Aspx URI. Furthermore, because IIS and ASP.NET dynamically compile web scripts upon execution, compiled DLLs and .Compiled metadata files were generated within the server's Temporary ASP.NET Files directory, providing forensic analysts with evidence of the execution path and associated Suo5 activity.
In the second confirmed incident, AhnLab detailed a memory injection attack against a Java-based Jenkins automation server that eliminated the need for disk-resident web shells. After securing administrator-level privileges on the server, the attacker leveraged Jenkins' built-in Script Console, an administrative utility intended for running arbitrary Groovy scripts. Using a crafted Groovy script, the attacker loaded and registered Suo5's proxy logic directly into runtime memory as a Java Servlet and Filter.
What To Watch
Because this memory injection approach avoided dropping executable files to disk, traditional file-integrity monitoring did not observe new files. Forensic discovery instead relied on access logs and Java runtime diagnostic output. Web access logs recorded external requests targeting endpoints such as /login.Php or /login. Concurrently, internal application logs revealed the registration of a PluginServletFilter chain, a doFilter() invocation linked to Script1.Groovy, and an error stack trace indicating a ClassFormatError.
AhnLab emphasizes that defenders should avoid relying strictly on static indicators of compromise like individual file hashes. Instead, defensive teams must correlate web request patterns, server-side execution events, and internal network communications. Key anomalies include web requests pointing to uncommon URIs, unusual frequencies of POST requests, atypical User-Agent headers, and web server interactions occurring outside of standard business hours.
To mitigate tunneling risks, AhnLab advises administrators to monitor web application directories for newly created or modified files, constrain internal network access scopes to limit lateral movement paths, and maintain endpoint protection through antivirus and EDR platforms. Additionally, organizations running administrative web services should restrict or disable server-side script execution engines, such as Groovy-based consoles, to prevent unauthorized in-memory payload execution.
Event Type: security
Importance: medium
Affected Companies
- AhnLab
Affected Sectors
- Cybersecurity
Key Numbers
- MD5 hash: 810726bb14e100a122cd8fc189eb087f
Timeline
- AhnLab ASEC publishes technical case studies analyzing Suo5-based tunneling and pivoting techniques.
Frequently Asked Questions
What is Suo5 and how is it used in attacks?
Suo5 is an HTTP and HTTPS tunneling tool designed to relay TCP traffic and allow access to internal networks via a SOCKS5 proxy. Attackers use it for pivoting, leveraging compromised web servers as relay points to bypass perimeter controls and move laterally into internal environments.
How did the attacker deploy Suo5 on the Windows IIS server?
The attacker exploited a file upload vulnerability to place Suo5.Aspx onto a Windows Server-based IIS web server after renaming the file to FilesImages.Aspx. The script then established a communication path used to expand the attack surface to internal systems.
How was the fileless Suo5 memory injection executed on Jenkins?
After gaining administrator privileges on a Java-based Jenkins server, the attacker accessed the Script Console to run Groovy scripts. The script dynamically registered the Suo5 tunneling capability directly into runtime memory as a Servlet and Filter without writing standalone files to disk.
What traces identify Suo5 activity in web and Java logs?
Traces include repeated POST requests to uploaded endpoints such as FilesImages.Aspx, newly generated DLL and .Compiled files in the Temporary ASP.NET Files directory, web log requests for /login or /login.Php, and Java logs showing PluginServletFilter, doFilter() calls in Script1.Groovy, or ClassFormatError stack traces.