Loading story…
Attackers exploited the ProxyNotShell chain on on-premises Microsoft Exchange Server by combining CVE-2022-41040, an authenticated SSRF flaw, with CVE-2022-41082, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server 2013, 2016, and 2019 were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused WSMAN and XML SOAP traffic to establish remote shell access.
Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including 193.149.185.52:443 and sync.service.auzreservices.com, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2022-10-11, Microsoft released patches for the Exchange zero-days CVE-2022-41040 and CVE-2022-41082 after in-the-wild exploitation had been observed.
Kaspersky observed successful exploitation of the vulnerabilities followed by reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell activity, and published related indicators of compromise including malicious files and C2 infrastructure.
Microsoft later confirmed that Exchange Server 2013, 2016, and 2019 were affected by the ProxyNotShell attack chain involving CVE-2022-41040 and CVE-2022-41082.
GTSC reported that CVE-2022-41040 and CVE-2022-41082 were used together in an attack in August 2022 targeting critical infrastructure via on-premises Microsoft Exchange Server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **ProxyShell**, a chain of Microsoft Exchange vulnerabilities that can be combined to bypass authentication, escalate privileges, and achieve remote code execution on exposed Exchange servers. Orange Tsai described the attack surface and showed how flaws including `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` could be chained to reach backend Exchange services and execute attacker-controlled code without valid credentials. Mandiant later reported real-world exploitation of ProxyShell against internet-facing Exchange environments, showing that attackers used the chain to gain shells on compromised servers and establish persistent access. The reporting underscores that unpatched on-premises Exchange systems remained a high-value target because successful exploitation could hand attackers direct control of email infrastructure, enable follow-on intrusion activity, and expose sensitive enterprise communications.
Jul 12, 2026
A critical Microsoft Exchange Server flaw, **CVE-2021-34473**, enabled unauthenticated attackers to reach privileged backend services through improper URI validation and URL normalization in the Client Access Service and autodiscover functionality. The bug is the first stage of the **ProxyShell** attack chain and has been widely tied to in-the-wild exploitation, with affected builds including Exchange Server 2013 `CU23`, Exchange Server 2016 `CU19` and `CU20`, and Exchange Server 2019 `CU8` and `CU9`. Attackers have used the issue to bypass authentication, access Exchange PowerShell, read mailboxes, deploy webshells, exfiltrate email, and move laterally, especially when chaining it with **CVE-2021-34523** and **CVE-2021-31207** for full compromise. Public exploitation resources, including GitHub tooling and scanning templates, lowered the barrier to abuse, while defenders were urged to apply Microsoft's security updates, hunt for webshell indicators and suspicious autodiscover requests, monitor for PowerShell launched by `w3wp.exe`, and reduce external exposure of Exchange services.
Jun 29, 2026
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026