Loading story…
Attackers exploited unpatched on-premises Microsoft Exchange servers vulnerable to ProxyShell to gain initial access, deploy web shells and malicious .NET payloads, and abuse the compromised mail environment. In one intrusion, the Exchange server was used to send phishing replies from hijacked legitimate email threads to internal and external recipients, delivering DatopLoader followed by QBot; the activity then expanded into reconnaissance, persistence, command-and-control traffic, credential theft via registry hive dumping, and lateral movement with Cobalt Strike across the victim domain.
Separate analysis of ProxyShell post-exploitation found threat actors loading DLLs in memory from Exchange web processes, enumerating Exchange and Active Directory assets, testing domain controllers for Zerologon, extracting hashed credentials, and using pass-the-hash for persistence. One payload, Thor.dll, created domain accounts disguised as healthmailbox users and granted them the ApplicationImpersonation role, allowing covert access to and sending of email from any mailbox in the organization, underscoring how Exchange compromise can be turned into both malware delivery and long-term mailbox takeover.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Microsoft released KB5003435 to patch CVE-2021-31207, completing fixes for the three Exchange vulnerabilities known as ProxyShell.
Microsoft released KB5001779 to patch CVE-2021-34473 and CVE-2021-34523, two vulnerabilities later grouped as part of ProxyShell affecting on-premises Exchange Server.
The intrusion progressed to lateral movement across victim domains using Cobalt Strike Jump psexec and psexec_psh, while attackers also dumped SYSTEM, SECURITY, and SAM registry hives to obtain credentials.
After execution, QBot injected into explorer.exe, created scheduled-task persistence, contacted command-and-control servers, and performed host, network, and Active Directory reconnaissance using Adfind.exe and native Windows tools.
Victims who enabled macros in malicious Excel files triggered DatopLoader, which created the C:\Datop folder, downloaded DLL payloads, and executed them via regsvr32.exe, after which QBot took control of the host.
In a highlighted intrusion, attackers used the compromised Exchange server to send phishing emails as replies to legitimate stolen email threads, targeting internal and external recipients with DatopLoader-laced ZIP archives.
Cybereason investigated multiple 2021 compromises in which attackers exploited ProxyShell vulnerabilities on unpatched on-premises Microsoft Exchange servers for initial access.
FortiEDR detected suspicious activity when w3wp.exe injected into vbc.exe and loaded malicious DLLs in memory; Fortinet said protection mode blocked the malicious actions and prevented creation of domain accounts or further activity.
Using credentials obtained via Zerologon, Thor.dll created domain accounts masquerading as healthmailbox accounts and assigned them the Exchange ApplicationImpersonation role, enabling access to and sending of email from any mailbox in the organization.
In the FortiGuard-observed campaign, a DLL module probed specified domain controllers for Zerologon exposure and, when successful, returned usernames and hashed passwords before restoring the original computer hash.
FortiGuard Labs reported a separate ProxyShell campaign in which an unidentified actor used web shells on compromised Exchange servers to load 22 malicious .NET DLLs in memory for reconnaissance and follow-on actions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybereason.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited the **ProxyShell** chain in unpatched on-premises Microsoft Exchange servers to gain remote code execution, plant web shells, and establish persistent access, with incidents linked to **LockFile** ransomware deployment. The intrusion path combined `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` to bypass authentication, escalate privileges, and execute code through exposed Exchange services, while broad internet scanning targeted Exchange Client Access Service instances over IIS. Reporting also warned that applying Exchange updates blocks new exploitation but does not remove web shells or other attacker footholds already left behind on compromised servers. Post-compromise activity included PowerShell-based payload delivery, Cobalt Strike deployment, privilege escalation, and in some cases abuse of **PetitPotam** (`CVE-2021-36942`) for NTLM relay and deeper domain compromise. Researchers described attackers using Exchange web shells, suspicious `.aspx` files, `w3wp.exe` child processes, mailbox export abuse, scheduled tasks, and Active Directory Group Policy plus the `NETLOGON` share to spread ransomware across enterprise environments, turning an initial Exchange breach into domain-wide encryption.
Aug 15, 2026
Attackers exploited the **ProxyNotShell** chain on on-premises Microsoft Exchange Server by combining `CVE-2022-41040`, an authenticated SSRF flaw, with `CVE-2022-41082`, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server **2013, 2016, and 2019** were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused `WSMAN` and XML SOAP traffic to establish remote shell access. Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including `193.149.185.52:443` and `sync.service.auzreservices.com`, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Jun 29, 2026
Researchers detailed **ProxyShell**, a chain of Microsoft Exchange vulnerabilities that can be combined to bypass authentication, escalate privileges, and achieve remote code execution on exposed Exchange servers. Orange Tsai described the attack surface and showed how flaws including `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` could be chained to reach backend Exchange services and execute attacker-controlled code without valid credentials. Mandiant later reported real-world exploitation of ProxyShell against internet-facing Exchange environments, showing that attackers used the chain to gain shells on compromised servers and establish persistent access. The reporting underscores that unpatched on-premises Exchange systems remained a high-value target because successful exploitation could hand attackers direct control of email infrastructure, enable follow-on intrusion activity, and expose sensitive enterprise communications.
Jul 12, 2026