Advisory ID: NCC-CSIRT-2026-024
Summary:
A Remote Code Execution (RCE) incident involving the execution of malicious code on a Windows endpoint has been observed within the Communications Sector. The activity involved the abuse of legitimate Windows components to retrieve and execute a malicious payload from a remote server, allowing unauthorized code execution on the affected system.
This technique can enable threat actors to compromise endpoints, evade traditional security controls, and potentially establish further access within a network. Organizations are advised to review their security controls and implement the recommended mitigation measures to reduce the risk of similar attacks.Damage: High
Probability: High
Product(s):
Microsoft Windows Operating System
Version(s):
All versions supporting WebClient/WebDAV and rundll32 execution (various Windows builds).
Platform(s):
Windows endpoints in enterprise and communications infrastructure environments.
Description:
A Remote Code Execution (RCE) incident was observed in which a threat actor leveraged Windows native functionality to remotely retrieve and execute a malicious DLL payload. The attack utilized a Living-off-the-Land (LotL) technique involving the execution of rundll32.exe through cmd.exe, combined with the abuse of the Windows WebClient service and WebDAV protocol.
The malicious payload was hosted on attacker-controlled infrastructure and delivered over HTTPS through a WebDAV-accessible UNC path. Upon execution, the Windows WebClient service translated the remote resource request into WebDAV traffic, enabling the payload to be dynamically loaded and executed without a traditional file download to disk.
Observed indicators included suspicious cmd.exe → rundll32.exe process chains, WebDAV-related HTTPS traffic, and use of the HTTP PROPFIND method, remote DLL execution, and communication with a newly registered domain used for payload delivery. This technique can significantly reduce forensic visibility and increase the likelihood of evading conventional file-based security controls.
If successful, the attack may result in unauthorized code execution, endpoint compromise, persistence, credential theft, lateral movement, and further malicious activity within the affected environment.Impacts:
Successful exploitation may result in:
- Full remote execution of attacker-controlled code on endpoints
- Execution of malicious DLL payloads without writing files to disk
- Potential credential theft or system manipulation
- Possible lateral movement across enterprise networks
- Reduced detection due to legitimate Windows process abuse
- Compromise of user endpoints in communications environments
Threat Types:
- Remote Code Execution (RCE)
- Living-off-the-Land (LOLBIN) Abuse
- WebDAV-based Payload Delivery
- Command Execution via Native Windows Tools
- Endpoint Evasion Techniques
Solutions/Mitigations:
NCC-CSIRT recommends the following mitigation steps:
- Disable unnecessary WebDAV services and functionality.
- Monitor for suspicious cmd.exe and rundll32.exe execution.
- Restrict outbound WebDAV and remote file-share access where possible.
- Block known malicious domains and indicators of compromise.
- Enable enhanced endpoint monitoring and command-line logging.
- Conduct threat hunting for similar activity across the environment.
- Review EDR rules to detect abuse of legitimate Windows utilities.
- Investigate affected systems and remediate identified threats.
References: