Security News > 2023 > February > Microsoft Exchange ProxyShell flaws exploited in new crypto-mining attack

A new malware dubbed 'ProxyShellMiner' exploits the Microsoft Exchange ProxyShell vulnerabilities to deploy cryptocurrency miners throughout a Windows domain to generate profit for the attackers.
ProxyShell is the name of three Exchange vulnerabilities discovered and fixed by Microsoft in 2021.
In attacks seen by Morphisec, the threat actors exploit the ProxyShell flaws tracked as CVE-2021-34473 and CVE-2021-34523 to gain initial access to the organization's network.
For the malware to activate, it requires a command line parameter that also dubs as a password for the XMRig miner component.
That file decides which browser of those installed on the compromised system will be used for injecting the miner into its memory space, using a technique known as "Process hollowing." After that, it picks a random mining pool from a hardcoded list, and the mining activity begins.
Possibly, the miner continues to communicate with its mining pool via a backdoor that isn't monitored by security tools.
News URL
Related news
- Triplestrength hits victims with triple trouble: Ransomware, cloud hijacks, crypto-mining (source)
- CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks (source)
- Critical RCE bug in Microsoft Outlook now exploited in attacks (source)
- Microsoft Identifies 3,000 Leaked ASP.NET Keys Enabling Code Injection Attacks (source)
- Microsoft Uncovers Sandworm Subgroup's Global Cyber Attacks Spanning 15+ Countries (source)
- North Korea targets crypto developers via NPM supply chain attack (source)
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- Microsoft spots XCSSET macOS malware variant used for crypto theft (source)
- Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now (source)
- Microsoft fixes Power Pages zero-day bug exploited in attacks (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2021-07-14 | CVE-2021-34523 | Unspecified vulnerability in Microsoft Exchange Server 2013/2016/2019 Microsoft Exchange Server Elevation of Privilege Vulnerability | 0.0 |
2021-07-14 | CVE-2021-34473 | Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server 2013/2016/2019 Microsoft Exchange Server Remote Code Execution Vulnerability | 0.0 |