Hackers now backdoor Microsoft Exchange using ProxyShell exploits

Minimalist · Aug 12, 2021

Threat actors are actively exploiting Microsoft Exchange servers using the ProxyShell vulnerability to install backdoors for later access.

ProxyShell is the name of an attack that uses three chained Microsoft Exchange vulnerabilities to perform unauthenticated, remote code execution.
Click to expand...

https://www.bleepingcomputer.com/ne...microsoft-exchange-using-proxyshell-exploits/

guest · Aug 21, 2021

Almost 2,000 Exchange servers hacked using ProxyShell exploit
August 21, 2021
https://therecord.media/almost-2000-exchange-servers-hacked-using-proxyshell-exploit/

Almost 2,000 Microsoft Exchange email servers have been hacked over the past two days and infected with backdoors after owners did not install patches for a collection of vulnerabilities known as ProxyShell.

The attacks, detected by security firm Huntress Labs, come after proof-of-concept exploit code was published online earlier this month, and scans for vulnerable systems began last week.
Click to expand...

Attacks intensified this week, and even a new ransomware operation known as LockFile began using the ProxyShell exploit as a way to enter corporate networks.

Keep your Exchange servers safe this weekend. @HuntressLabs has seen 140+ webshells across 1900+ unpatched boxes in 48hrs. Impacted orgs thus far include building mfgs, seafood processors, industrial machinery, auto repair shops, a small residential airport and more. #ProxyShell pic.twitter.com/clhQ0E5rnR
— Kyle Hanslovan (@KyleHanslovan) August 20, 2021
According to indicators of compromise shared by Huntress Labs, some of the web shells installed on hacked servers appear to use the same file name patterns as the web shells used in attacks exploiting the ProxyLogon vulnerabilities earlier this year, suggesting that largely the same threat actors might be involved in the ProxyShell attacks today.
Click to expand...

ronjor · Aug 21, 2021

Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities
Original release date: August 21, 2021

Malicious cyber actors are actively exploiting the following ProxyShell vulnerabilities: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. An attacker exploiting these vulnerabilities could execute arbitrary code on a vulnerable machine. CISA strongly urges organizations to identify vulnerable systems on their networks and immediately apply Microsoft's Security Update from May 2021—which remediates all three ProxyShell vulnerabilities—to protect against these attacks.
Click to expand...

Log in or Sign up

Hackers now backdoor Microsoft Exchange using ProxyShell exploits

Minimalist Registered Member

guest Guest

ronjor Global Moderator

Log in or Sign up

Hackers now backdoor Microsoft Exchange using ProxyShell exploits

Minimalist Registered Member

guest Guest

ronjor Global Moderator

Useful Searches