Loading story…
Attackers exploited two Microsoft Exchange zero-days, CVE-2022-41040 and CVE-2022-41082, in a campaign discovered by GTSC during an August 2022 investigation into an attack on critical infrastructure. GTSC disclosed the vulnerabilities on September 29, 2022, and Microsoft confirmed active exploitation. Known as ProxyNotShell, the flaws affect on-premises Exchange deployments and allow an authenticated attacker to chain server-side request forgery with remote code execution.
SecurityScorecard identified more than 48,000 Exchange assets and examined possible webshell infections and communications associated with published indicators of compromise. Network-flow analysis revealed potentially relevant remote PowerShell traffic and large transfers involving a reported command-and-control server, but did not establish exploitation or data exfiltration; the asset count likewise did not represent confirmed infections. At the investigation’s September 30, 2022 cutoff, no patch was available. The report recommended checking for compromise, deploying Microsoft’s detections, and restricting public access to Exchange and remote PowerShell services.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
SecurityScorecard's Attack Surface Intelligence identified more than 48,000 assets running Exchange servers as of September 30. Identification alone did not establish that those servers were vulnerable or compromised.
GTSC disclosed CVE-2022-41040 and CVE-2022-41082 following its investigation of active exploitation. The flaws affect on-premises Exchange and allow an authenticated attacker to chain server-side request forgery with remote code execution.
SecurityScorecard recorded another transfer of a reported 4.5 MB from 104.90.25.126 to 185.220.101.182 over port 5986. Traffic involving the indicator could not automatically be attributed to the Exchange vulnerabilities.
SecurityScorecard observed 69.55.53.168 transferring 12.29 MB to 185.220.101.182 over port 5986. Researchers attributed the source address to ServerStack but did not establish that the transfer represented Exchange exploitation.
SecurityScorecard observed 104.90.25.126 transferring a reported 4.5 MB to 185.220.101.182 over port 5986. The source address belonged to shared Akamai infrastructure in Belgium, and the observation did not establish compromise of its associated organizations.
SecurityScorecard observed 86.48.12.64 sending 126 bytes to port 5985 on 160.238.137.146, which returned 330 bytes that day. The traffic did not establish exploitation of the Exchange vulnerabilities.
GTSC first observed exploitation of previously unknown Microsoft Exchange vulnerabilities while investigating an attack against critical infrastructure. The flaws were subsequently identified as CVE-2022-41040 and CVE-2022-41082.
SecurityScorecard's investigation identified potentially compromised entities, including US educational institutions, and 40 HTTPS flows of at least 100 MB involving the reported command-and-control address and 22 counterpart addresses. Researchers cautioned that webshell-path results included false positives and that the transfers did not conclusively demonstrate targeting or exfiltration.
GTSC published 17 exploitation-associated IP indicators and identified 137.184.67.33 as a command-and-control address specifically associated with exploitation of the Exchange vulnerabilities.
Microsoft confirmed active exploitation of CVE-2022-41040 and CVE-2022-41082, with evidence of limited, targeted attacks against on-premises Exchange deployments.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited the Microsoft Exchange Server vulnerabilities **CVE-2022-41040** and **CVE-2022-41082**, widely known as **ProxyNotShell**, to gain remote code execution on vulnerable on-premises deployments. Microsoft disclosed the attacks and analyzed the exploit chain, which abuses the two flaws together, while affected products included supported **Exchange Server 2013, 2016, and 2019** cumulative update versions; **Exchange Online** was not affected. Security monitoring in the weeks after disclosure showed sustained scanning and exploitation attempts, with one SOC reporting activity beginning on October 3 and continuing intermittently through November, and more than 90% of observed source countries tied to the United States. Many requests appeared to use the **ZGrab** scanning tool based on `User-Agent` headers, and public proof-of-concept code increased the likelihood of continued abuse. Microsoft released patches for affected Exchange versions, and organizations running on-premises Exchange were urged to apply the vendor fixes without delay.
Aug 15, 2026
Attackers exploited the **ProxyNotShell** chain on on-premises Microsoft Exchange Server by combining `CVE-2022-41040`, an authenticated SSRF flaw, with `CVE-2022-41082`, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server **2013, 2016, and 2019** were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused `WSMAN` and XML SOAP traffic to establish remote shell access. Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including `193.149.185.52:443` and `sync.service.auzreservices.com`, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Jun 29, 2026
Microsoft warned that attackers were actively exploiting a zero-day chain in on-premises Microsoft Exchange Server, later tracked as **ProxyNotShell** and assigned `CVE-2022-41040` and `CVE-2022-41082`. The flaws affected Exchange Server 2013, 2016, and 2019, while **Exchange Online was not affected**. The attack chain used a server-side request forgery (**SSRF**) bug to reach PowerShell remoting and achieve remote code execution, and reports indicated the activity required valid email credentials from a non-admin user. Microsoft and security researchers urged organizations to apply interim protections immediately, including an **IIS URL Rewrite** rule to block known exploit paths and restricting or disabling **Remote PowerShell** where possible. Guidance also highlighted the need to review IIS logs and related telemetry for signs of compromise, as the campaign was reportedly already being used in real-world attacks and drew comparisons to the earlier **ProxyShell** exploitation wave.
Aug 6, 2026