Hackers are actively targeting Microsoft Exchange servers using ProxyShell exploit

Hackers are actively targeting Microsoft Exchange servers using ProxyShell exploit

Threat actors are actively scanning for unpatched Microsoft Exchange servers vulnerable to the latest set of flaws in Exchange software known as “ProxyShell” that were fixed by Microsoft earlier this year.

Tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, the vulnerabilities allow attackers to elevate privileges on the Exchange PowerShell backend and perform unauthenticated, remote code execution.

The attacks targeting vulnerable Exchange servers started soon after proof-of-concept exploit code was published online. According to the security firm Huntress Labs that first detected the attacks, at least five distinct styles of webshells were observed being deployed to vulnerable Microsoft Exchange servers, with over 100 incidents related to the exploit reported in just two days – between August 17 and 18. The researchers said that attackers use the ProxyShell exploit to install a backdoor for later access and post-exploitation.

Huntress Labs’ investigation into the hacked Exchange servers revealed more than 140 different web shells on more than 1,900 Exchange servers.

“Impacted orgs thus far include building mfgs, seafood processors, industrial machinery, auto repair shops, a small residential airport and more,” Kyle Hanslovan, CEO and co-founder of Huntress Labs tweeted.

Huntress Labs has shared Indicators of Compromise to help system administrators to determine if their servers are vulnerable to this threat.

Back to the list

Latest Posts

New PhaaS platform Lucid targets 169 entities across 88 countries using iMessage and RCS

New PhaaS platform Lucid targets 169 entities across 88 countries using iMessage and RCS

Lucid is capable of sending up to 100,000 smishing messages per day.
1 April 2025
Surge in attacks targeting Palo Alto networks gateways observed

Surge in attacks targeting Palo Alto networks gateways observed

The activity began on March 17, 2025, and persisted at a rate of nearly 20,000 unique IP addresses per day.
1 April 2025
Canadian hacker arrested for allegedly stealing data from Texas Republican Party

Canadian hacker arrested for allegedly stealing data from Texas Republican Party

Cottle allegedly hacked  third-party hosting company Epik that managed the website for the Texas Republican Party.
1 April 2025