Security News > 2021 > August > Hackers Deploying Backdoors on Exchange Servers via ProxyShell Vulnerabilities

Threat actors have started exploiting the recently disclosed Microsoft Exchange Server vulnerabilities to deliver web shells that give them access to the compromised system.

Orange Tsai, principal researcher at security consulting firm DEVCORE, recently disclosed the details of three Exchange vulnerabilities that can be exploited by remote, unauthenticated attackers to take control of vulnerable servers.

Shortly after Orange Tsai disclosed the technical details of the ProxyShell attack at the Black Hat and DEF CON conferences last week, hackers started scanning the internet for vulnerable Exchange servers.

Researchers Rich Warren and Kevin Beaumont reported on Thursday that their honeypots had recorded attempts to deploy web shells through the ProxyShell vulnerabilities.

It's worth noting that the Exchange vulnerabilities tracked as ProxyLogon, which Orange Tsai found during the same research project and disclosed earlier this year, have been exploited by both profit-driven cybercriminals and state-sponsored threat actors, for various purposes.

Threat intelligence firm Bad Packets said on Thursday that it continued to see mass scanning activity looking for Exchange servers exposed to ProxyShell attacks.

News URL

http://feedproxy.google.com/~r/securityweek/~3/jBJzbyfy1fQ/hackers-deploying-backdoors-exchange-servers-proxyshell-vulnerabilities