Loading story…
Attackers exploited the Microsoft Exchange ProxyLogon vulnerability to compromise unpatched Exchange servers and install a Monero cryptominer. The campaign used already-compromised Exchange servers to host a staged batch downloader, allowing the malware to spread by targeting other vulnerable systems exposed to the internet.
The intrusion chain abused certutil.exe to decode a base64-encoded payload named QuickCPU.exe, then injected the miner into a running system process to reduce detection. Researchers found the payload contained xmr-stak components and was configured to connect over TLS to a mining pool tied to the wallet label "DRUGS," indicating an opportunistic post-exploitation operation that monetized Exchange access through illicit cryptocurrency mining.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
According to the Monero blockchain, the wallet used in the campaign began receiving funds on March 9. The miner was configured to connect over TLS to the attacker’s pool using the name "DRUGS."
While investigating customer telemetry from an Exchange server, SophosLabs identified a staged infection chain that fetched a fake ZIP batch script, used certutil.exe to decode a base64-wrapped payload into QuickCPU.exe, and injected the miner into a running process to evade detection.
SophosLabs said the unknown attacker’s campaign exploiting ProxyLogon to deploy a Monero cryptominer began around March 9. The attacker used compromised Exchange servers to host staged payloads for infecting other vulnerable Exchange servers.
Microsoft disclosed the serious Exchange Server vulnerability known as ProxyLogon, after which multiple threat actors began targeting exploitable Exchange servers with malware including webshells and ransomware.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybereason reported incident response cases in which the **Prometei** botnet compromised organizations in North America by exploiting Microsoft Exchange vulnerabilities `CVE-2021-27065` and `CVE-2021-26858` for initial access. After entry, the operators deployed a modular malware framework that included components such as `sqhost.exe`, `rdpcIip.exe`, `ExchDefender.exe`, `Miwalk.exe`, `Nethelper`, `Windrlver.exe`, and an XMRig-based `SearchIndexer.exe`, enabling both **Monero cryptomining** and persistent access. Research from Cisco Talos and CUJO AI shows Prometei has long operated as a **multi-stage, cross-platform botnet** with Windows and Linux variants, expanding well beyond mining into credential theft, reconnaissance, lateral movement, and backdoor activity. The malware spreads through stolen credentials, brute force, `SMB`/`RDP`, `SSH`, `SQL`, and exploits including **EternalBlue** and **BlueKeep**; investigators assessed the operators as financially motivated, Russian-speaking cybercriminals whose infrastructure and samples indicate the botnet has been active since at least 2016 and continues to evolve.
Aug 15, 2026
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Microsoft disclosed and patched four actively exploited on-premises Exchange Server vulnerabilities — `CVE-2021-26855`, `CVE-2021-26857`, `CVE-2021-26858`, and `CVE-2021-27065` — after investigators linked the initial intrusion wave to the China-linked **HAFNIUM** group. The flaws, later widely known as **ProxyLogon**, affected Exchange Server 2013, 2016, and 2019, with a defense-in-depth update also issued for Exchange 2010. Researchers said exploitation had begun by early January and rapidly expanded after public disclosure, with multiple threat actors using the bugs to gain remote access, drop **web shells** including **China Chopper** variants, steal email and files, dump credentials, and move laterally across victim networks. Security agencies and vendors warned that patching alone did not remove attacker access because many servers had already been backdoored, prompting urgent guidance to review Exchange `HttpProxy` and IIS logs, hunt for suspicious `w3wp.exe` child processes, PowerShell abuse, LSASS dumping, and unauthorized admin creation. The campaign hit organizations globally, including Norway’s parliament, and U.S. authorities later obtained court approval for an FBI operation that removed malicious web shells from hundreds of vulnerable U.S.-based Exchange servers. Microsoft, CISA, the FBI, and incident responders urged defenders to patch immediately, restrict exposure where possible, and conduct full compromise assessments because mass exploitation continued well beyond the initial disclosure.
Aug 15, 2026