Thursday, May 8, 2025
HomeMalwareHackers Attack MS Exchange Servers Using ProxyShell & ProxyLogon Exploits to Distribute...

Hackers Attack MS Exchange Servers Using ProxyShell & ProxyLogon Exploits to Distribute Malware

Published on

SIEM as a Service

Follow Us on Google News

Hackers are Targeting Microsoft Exchange servers using exploits to distribute malware. The vulnerabilities allow hackers to bypass detection by sending emails with malware attachments or messages containing malicious links to internal employees. This is done by abusing the Exchange server’s built-in features, ProxyShell and ProxyLogon.

Threat actors use a number of strategies to mislead the user into opening the email and clicking on the malicious attachment. They can impersonate a legitimate sender, include a sense of urgency or click-bait subject line, or use a low-quality crafted email that looks like it was sent from an unprofessional company.

TrendMicro researchers have discovered a clever tactic of using compromised Microsoft Exchange servers to distribute malicious emails to a company’s internal users. 

- Advertisement - Google News

All this is done by sending an infected email to the victim and then forwarding it to all of the victim’s contacts in their address book.

The emails will appear to be sent from the victim’s own account and the subject line will be formatted like a normal email.

Microsoft Exchange infection

It is believed that the hackers behind this attack are from the ‘TR’ group, it’s a well-known hacker group that distributes emails with malicious attachments that drop malware. Even TR has been spotted in the past using the following file formats in their emails:-

  • Microsoft Office Files (.doc, .xls, .ppt)
  • Rich Text Format (.rtf) 
  • Portable Document Format (.pdf)
  • Single File Web Page (.mht)
  • Compiled HTML (.chm)
  • Compiled Help File (.chm or .hlp)
  • Shell Executable files (.exe, .com, or .bat)

The payloads that are used are:-

  • Qbot
  • IcedID
  • Cobalt Strike
  • SquirrelWaffle

Moreover, Trend Micro has claimed that “In the same intrusion, we analyzed the email headers for the received malicious emails, the mail path was internal (between the three internal exchange servers’ mailboxes), indicating that the emails did not originate from an external sender, open mail relay, or any message transfer agent (MTA).”

Since these emails are coming from the same internal network, it is safe to assume that they are legitimate. The tone of the emails is conversational while still maintaining a professional tone.

It’s an excellent tactic used by hackers for not raising any alarms on the email protection systems.

Vulnerabilities Exploited

Here are the vulnerabilities that are exploited:-

  • CVE-2021-34473: The pre-auth path confusion
  • CVE-2021-34523: Exchange PowerShell backend elevation-of-privilege
  • CVE-2021-26855: The pre-authentication proxy vulnerability

Always keep your Exchange servers updated

For later backdoor access the hackers deploy ransomware or install webshells by exploiting both ProxyShell and ProxyLogon vulnerabilities. And these attacks god so bad that without informing the servers’ owners the FBI removed webshells from all the available compromised US-based Microsoft Exchange servers.

That’s why the cybersecurity experts strongly recommend users immediately update their Exchange servers, and make sure the firewall is up to date and well configured. 

Even you should also make sure that you’re running the latest version of the anti-malware software for your operating system. If you’re not sure, then contact your IT support provider.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector...

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its...

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

SpyCloud, the leading identity threat protection company, today released an analysis of nearly 6...

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Lampion Banking Malware Uses ClickFix Lures to Steal Banking Credentials

Unit 42 researchers at Palo Alto Networks, a highly targeted malicious campaign orchestrated by...

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...