Loading story…
Pawn Storm—also tracked as APT28 and Forest Blizzard—conducted sustained operations against high-value organizations by combining spear-phishing with large-scale Net-NTLMv2 hash relay activity targeting Microsoft Exchange environments. Trend Micro reported that from roughly April 2022 through November 2023, the group repeatedly targeted government bodies and critical sectors including foreign affairs, energy, defense, transportation, finance, local government, courts, and central banking, with victims spanning Europe, North America, South America, Asia, Africa, and the Middle East.
The campaign was described as noisy but effective, using repeated authentication-relay attempts as a cost-efficient way to gain access to email accounts at scale. Reported post-compromise activity included changing mailbox folder permissions to maintain persistence and sending malicious internal emails from hijacked accounts to expand access inside victim organizations, while related guidance on detecting malicious activity against Microsoft Exchange servers underscores the focus on Exchange infrastructure as a key attack surface.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that the observed NTLMv2 hash relay activity persisted until approximately November 2023. The campaign featured major spikes in targeting volume and was associated with post-exploitation activity such as mailbox permission changes for persistence and malicious internal emails for lateral movement.
From approximately April 2022 through November 2023, Pawn Storm attempted NTLMv2 hash relay attacks at scale against high-value targets worldwide. The targeting shifted across government departments and critical sectors including foreign affairs, energy, defense, transportation, finance, local government, and military-related entities.
Beginning in May 2019, Pawn Storm used compromised high-profile email accounts to send credential-phishing spam and conducted daily probes of webmail, Exchange Autodiscover, and other email-related services worldwide. Trend Micro also linked the group to broader late-2019 scans for vulnerable Microsoft SQL Server and Directory Services hosts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourcewojsko-polskie.pl
Open sourcedocuments.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said Russian state-backed threat actor **Forest Blizzard** (also tracked as **APT28** or **STRONTIUM**) actively exploited **`CVE-2023-23397`**, a critical Outlook for Windows elevation-of-privilege flaw that can leak a victim’s **Net-NTLMv2** hash through a specially crafted reminder message **without user interaction**. The stolen hash can then be used in **NTLM relay** attacks against Exchange, allowing attackers to access Exchange-hosted mailboxes, move laterally, and establish persistence. Microsoft said exploitation dated back to at least April 2022 and linked the activity to the GRU-associated actor previously tied by U.S. and U.K. authorities to **Unit 26165**. Reporting from Microsoft and other security firms tied the campaign to broader Russian espionage operations targeting government, military, energy, transportation, research, and other strategic organizations, with Unit 42 saying at least **30 organizations in 14 countries** were affected over roughly 20 months, many in NATO states. Investigators observed attackers abusing **Exchange Web Services** and modifying mailbox folder permissions to retain unauthorized access to mailbox contents, a technique also highlighted by Polish authorities. Microsoft urged defenders to patch Outlook, apply Exchange security updates, block outbound **SMB** on TCP 445, and reduce or disable NTLM exposure; it also noted that **Exchange Online** and updated Exchange Server builds can strip the malicious `PidLidReminderFileParameter` used in the attack chain.
Aug 14, 2026
German authorities warned that the Chinese-linked espionage group **APT27** was compromising commercial networks and maintaining access with the **HyperBro** remote access trojan, an in-memory backdoor used for persistence, remote administration, and data theft. The campaign was tied to exploitation of Microsoft Exchange **ProxyLogon** flaws, including `CVE-2021-26855`, `CVE-2021-26857`, `CVE-2021-26858`, and `CVE-2021-27065`, as well as overlap with attacks abusing Zoho ManageEngine vulnerabilities. Officials said the intrusions could expand into supply-chain compromises affecting customers and service providers, and released indicators of compromise and YARA rules to help defenders detect HyperBro and related command-and-control activity. Incident reports and threat research showed the Exchange compromises typically began with web shell deployment on exposed servers, followed by PowerShell-based reconnaissance, Active Directory enumeration, LSASS dumping, mailbox access, and attempts to package stolen data for exfiltration. In one detailed enterprise case attributed to APT27, the attackers moved laterally across multiple domains, escalated to domain administrator, extracted `NTDS.DIT`, staged data in password-protected RAR archives, and exfiltrated gigabytes of information through the Exchange server and HyperBro infrastructure while using DLL side-loading, masquerading, renamed tools, and Defender exclusions to evade detection. Researchers also warned that patching Exchange alone was not enough because many victims likely remained compromised through persistent web shells and other payloads.
Aug 15, 2026
Attackers exploited unpatched on-premises Microsoft Exchange servers vulnerable to **ProxyShell** to gain initial access, deploy web shells and malicious .NET payloads, and abuse the compromised mail environment. In one intrusion, the Exchange server was used to send phishing replies from hijacked legitimate email threads to internal and external recipients, delivering **DatopLoader** followed by **QBot**; the activity then expanded into reconnaissance, persistence, command-and-control traffic, credential theft via registry hive dumping, and lateral movement with **Cobalt Strike** across the victim domain. Separate analysis of ProxyShell post-exploitation found threat actors loading DLLs in memory from Exchange web processes, enumerating Exchange and Active Directory assets, testing domain controllers for **Zerologon**, extracting hashed credentials, and using pass-the-hash for persistence. One payload, `Thor.dll`, created domain accounts disguised as **healthmailbox** users and granted them the **ApplicationImpersonation** role, allowing covert access to and sending of email from any mailbox in the organization, underscoring how Exchange compromise can be turned into both malware delivery and long-term mailbox takeover.
Aug 14, 2026