Loading story…
Attackers actively exploited the ProxyShell chain in unpatched on-premises Microsoft Exchange servers to gain remote code execution, plant web shells, and establish persistent access, with incidents linked to LockFile ransomware deployment. The intrusion path combined CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 to bypass authentication, escalate privileges, and execute code through exposed Exchange services, while broad internet scanning targeted Exchange Client Access Service instances over IIS. Reporting also warned that applying Exchange updates blocks new exploitation but does not remove web shells or other attacker footholds already left behind on compromised servers.
Post-compromise activity included PowerShell-based payload delivery, Cobalt Strike deployment, privilege escalation, and in some cases abuse of PetitPotam (CVE-2021-36942) for NTLM relay and deeper domain compromise. Researchers described attackers using Exchange web shells, suspicious .aspx files, w3wp.exe child processes, mailbox export abuse, scheduled tasks, and Active Directory Group Policy plus the NETLOGON share to spread ransomware across enterprise environments, turning an initial Exchange breach into domain-wide encryption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
Microsoft's Exchange team published a warning urging users to apply the relevant patches quickly in response to ongoing ProxyShell exploitation.
By August 23, 2021, attackers including the LockFile ransomware group were exploiting ProxyShell and PetitPotam against enterprise environments, leading to ransomware deployment and host encryption.
Sophos reported that LockFile uses intermittent encryption, encrypting every alternate 16 bytes of a file to evade ransomware defenses based on statistical analysis. The analysis also described related behavior including WMI-based process termination, a LockBit-like ransom note, and self-deletion after encryption.
Public exploit code for ProxyShell became available on GitHub and Reddit, lowering the barrier to exploitation of unpatched Exchange servers.
An independent security researcher captured activity involving IP address 209.14.0[.]234 on August 13, 2021, which the report says was used to exploit ProxyShell vulnerabilities. The infrastructure was also linked to PowerShell retrieval activity observed during LockFile intrusions.
Microsoft's August 11, 2021 security updates included a patch for the PetitPotam-related Windows LSA spoofing vulnerability tracked as CVE-2021-36942.
A Taiwan security researcher presented details of the Exchange vulnerability chain at Black Hat USA 2021 and named the chain ProxyShell.
Microsoft released advisory ADV210003 warning about an NTLM relay attack related to Active Directory Certificate Services and the PetitPotam technique.
Symantec said the LockFile ransomware campaign was first observed on July 20, 2021, on the network of a U.S. financial organization. The attackers were assessed to have compromised Microsoft Exchange and later used PetitPotam to reach the domain controller before deploying ransomware.
A French researcher released proof-of-concept code for PetitPotam, enabling broader testing and abuse of the NTLM relay technique tied to CVE-2021-36942.
Microsoft's July 14, 2021 security updates included bulletins covering CVE-2021-34473 and CVE-2021-31207, drawing further attention to the Exchange flaws.
Microsoft disclosed additional Exchange vulnerabilities in its July 2021 security updates, including bulletins for CVE-2021-34473 and CVE-2021-31207.
Microsoft released KB5003435 in May 2021 to fix CVE-2021-31207, the arbitrary file write flaw used for remote code execution in the ProxyShell attack chain.
Microsoft released KB5001779 in April 2021 to fix CVE-2021-34473 and CVE-2021-34523, two of the Exchange vulnerabilities later used in the ProxyShell chain.
A security researcher reported multiple Microsoft Exchange Server vulnerabilities to Microsoft, beginning the disclosure process for the flaws later chained as ProxyShell.
Sophos said threat actors were actively scanning for and exploiting vulnerable on-premises Exchange servers and noted that LockFile appeared to be using ProxyShell against unpatched targets.
The Metasploit Framework was updated with exploits for the ProxyShell vulnerabilities, further operationalizing public exploitation.
Microsoft published KB5005413 with mitigation guidance for NTLM relay attacks involving PetitPotam against Active Directory Certificate Services. The guidance recommends enabling Extended Protection for Authentication, requiring HTTPS on AD CS web services, and restricting or disabling NTLM where possible.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcenews.sophos.com
Open sourcensfocusglobal.com
Open sourcecsoonline.com
Open sourcemsrc.microsoft.com
Open sourcesupport.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited the **ProxyNotShell** chain on on-premises Microsoft Exchange Server by combining `CVE-2022-41040`, an authenticated SSRF flaw, with `CVE-2022-41082`, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server **2013, 2016, and 2019** were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused `WSMAN` and XML SOAP traffic to establish remote shell access. Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including `193.149.185.52:443` and `sync.service.auzreservices.com`, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Jun 29, 2026
Researchers detailed **ProxyShell**, a chain of Microsoft Exchange vulnerabilities that can be combined to bypass authentication, escalate privileges, and achieve remote code execution on exposed Exchange servers. Orange Tsai described the attack surface and showed how flaws including `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` could be chained to reach backend Exchange services and execute attacker-controlled code without valid credentials. Mandiant later reported real-world exploitation of ProxyShell against internet-facing Exchange environments, showing that attackers used the chain to gain shells on compromised servers and establish persistent access. The reporting underscores that unpatched on-premises Exchange systems remained a high-value target because successful exploitation could hand attackers direct control of email infrastructure, enable follow-on intrusion activity, and expose sensitive enterprise communications.
Jul 12, 2026
Attackers exploited unpatched on-premises Microsoft Exchange servers vulnerable to **ProxyShell** to gain initial access, deploy web shells and malicious .NET payloads, and abuse the compromised mail environment. In one intrusion, the Exchange server was used to send phishing replies from hijacked legitimate email threads to internal and external recipients, delivering **DatopLoader** followed by **QBot**; the activity then expanded into reconnaissance, persistence, command-and-control traffic, credential theft via registry hive dumping, and lateral movement with **Cobalt Strike** across the victim domain. Separate analysis of ProxyShell post-exploitation found threat actors loading DLLs in memory from Exchange web processes, enumerating Exchange and Active Directory assets, testing domain controllers for **Zerologon**, extracting hashed credentials, and using pass-the-hash for persistence. One payload, `Thor.dll`, created domain accounts disguised as **healthmailbox** users and granted them the **ApplicationImpersonation** role, allowing covert access to and sending of email from any mailbox in the organization, underscoring how Exchange compromise can be turned into both malware delivery and long-term mailbox takeover.
Aug 14, 2026