Loading story…
Threat actors used unpatched Microsoft Exchange servers as an initial access point to deploy both Babuk and Cuba ransomware, with campaigns heavily affecting organizations in the United States and additional victims in other countries. Cisco Talos reported that a newer actor it tracks as Tortilla likely exploited ProxyShell to compromise Exchange, install the China Chopper web shell, stage payloads with PowerShell, and ultimately launch Babuk ransomware that appended the .babyk extension after disabling backup-related services and deleting VSS snapshots.
A separate intrusion set tied to Cuba ransomware also abused Exchange flaws, including ProxyShell and ProxyLogon, to breach corporate networks and deploy ransomware at scale. Mandiant said the actors, tracked as UNC2596 and associated with COLDDRAW, combined public Exchange exploitation with tools such as Bughatch, Wedgecut, Burntcigar, and Termite to maintain persistence, escalate privileges, move laterally, and disable defenses; the activity followed earlier FBI reporting that Cuba had compromised dozens of U.S. critical infrastructure organizations, underscoring the continued risk from internet-exposed, unpatched Exchange servers.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
In December 2021, the FBI issued a Cuba ransomware advisory warning that the group had breached 49 critical infrastructure organizations in the United States.
On October 12, 2021, Cisco Talos discovered a campaign in which Tortilla exploited vulnerable Microsoft Exchange servers, likely via ProxyShell, and deployed Babuk ransomware. The campaign primarily hit organizations in the United States, with additional victims in the United Kingdom, Germany, Ukraine, Finland, Brazil, Honduras, and Thailand.
GuidePoint later assessed with high confidence that a September 2021 'Ransomware Near Miss' it had investigated was attributable to the Cuba ransomware group (UNC2596). The incident began with ProxyShell exploitation and involved Cobalt Strike, Agent32.bin, and komar.ps1, but ransomware deployment was prevented.
Talos said the Babuk source code and a builder leaked in September 2021, likely enabling less experienced operators such as Tortilla to deploy the ransomware.
Mandiant identified UNC2596 exploiting Microsoft Exchange vulnerabilities, including ProxyShell and ProxyLogon, as early as August 2021 to gain initial access and deploy web shells, RATs, and backdoors.
Cisco Talos said the threat actor it tracks as Tortilla had been active since July 2021 and initially experimented with payloads including Powercat before deploying Babuk ransomware.
In May 2021, Cuba worked with Hancitor spam operators to gain initial access through DocuSign-themed phishing emails before later shifting toward exploiting public-facing services.
ProxyShell, an Exchange Server exploit chain, was demonstrated at Pwn2Own 2021. The chain was described as allowing an unauthenticated attacker to execute arbitrary commands on Exchange servers with port 443 exposed.
Mandiant reported that Cuba ransomware activity grew during 2020 and 2021 as the operation expanded its intrusions and ransomware deployments.
The Cuba ransomware operation began at the end of 2019, marking the start of the activity later tracked by Mandiant as UNC2596 and its payload as COLDDRAW.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceguidepointsecurity.com
Open sourceblog.talosintelligence.com
Open sourceblog.orange.tw
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited the **ProxyShell** chain in unpatched on-premises Microsoft Exchange servers to gain remote code execution, plant web shells, and establish persistent access, with incidents linked to **LockFile** ransomware deployment. The intrusion path combined `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` to bypass authentication, escalate privileges, and execute code through exposed Exchange services, while broad internet scanning targeted Exchange Client Access Service instances over IIS. Reporting also warned that applying Exchange updates blocks new exploitation but does not remove web shells or other attacker footholds already left behind on compromised servers. Post-compromise activity included PowerShell-based payload delivery, Cobalt Strike deployment, privilege escalation, and in some cases abuse of **PetitPotam** (`CVE-2021-36942`) for NTLM relay and deeper domain compromise. Researchers described attackers using Exchange web shells, suspicious `.aspx` files, `w3wp.exe` child processes, mailbox export abuse, scheduled tasks, and Active Directory Group Policy plus the `NETLOGON` share to spread ransomware across enterprise environments, turning an initial Exchange breach into domain-wide encryption.
Aug 26, 2026
Mandiant reported that threat actor **UNC2596** has been exploiting publicly known vulnerabilities in **Microsoft Exchange** and **Fortinet FortiOS** appliances to gain initial access and deploy **Cuba ransomware**. The activity shows the group chaining edge-device compromise with post-exploitation movement inside victim environments, using exposed enterprise infrastructure as an entry point before staging ransomware operations. The intrusion pattern highlights how attackers continue to weaponize unpatched perimeter systems to reach internal networks and deliver financially motivated payloads. Mandiant linked the observed operations to Cuba ransomware deployment, underscoring the ongoing risk from internet-facing appliances and email infrastructure when critical vulnerabilities remain unremediated.
Jul 12, 2026
Conti affiliates compromised an unpatched on-premises **Microsoft Exchange Server 2016** by exploiting the **ProxyShell** vulnerability chain, then established multiple web shells within minutes to secure persistent access. Investigators said the attackers quickly conducted reconnaissance, dumped **LSASS** credentials, and expanded access across the environment using a cracked domain administrator account while deploying tools including **Cobalt Strike** and **AnyDesk**. Over about five days, the intruders exfiltrated nearly **1 TB** of data using **Rclone** and **Mega** before launching **Conti** ransomware across the victim’s Windows network. The encryption phase was executed through batch scripts run from four servers, and the intrusion closely matched tactics documented in leaked Conti affiliate playbooks, underscoring how outdated Exchange cumulative updates left the organization exposed.
Aug 15, 2026