Loading story…
Conti affiliates compromised an unpatched on-premises Microsoft Exchange Server 2016 by exploiting the ProxyShell vulnerability chain, then established multiple web shells within minutes to secure persistent access. Investigators said the attackers quickly conducted reconnaissance, dumped LSASS credentials, and expanded access across the environment using a cracked domain administrator account while deploying tools including Cobalt Strike and AnyDesk.
Over about five days, the intruders exfiltrated nearly 1 TB of data using Rclone and Mega before launching Conti ransomware across the victim’s Windows network. The encryption phase was executed through batch scripts run from four servers, and the intrusion closely matched tactics documented in leaked Conti affiliate playbooks, underscoring how outdated Exchange cumulative updates left the organization exposed.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
After roughly five days in the environment, the attackers launched batch files from four servers to execute the ransomware payload across administrative shares on Windows systems. Sophos said the Conti ransomware was deployed to every machine on the victim network.
Within 48 hours of initial access, the operators exfiltrated roughly 1 terabyte of data from multiple servers. On the third day, they deployed Rclone and used a PowerShell script to copy data to Mega.
After obtaining domain administrator access, the attackers moved laterally via RDP and deployed persistence and remote access tooling including AnyDesk, Cobalt Strike, Splashtop, Remote Utilities, and the Atera Agent. Sophos reported that at least seven backdoors were installed during the intrusion.
Within 30 minutes of compromise, the attackers enumerated computers, domain controllers, and domain administrators, then used additional reconnaissance commands. Within about four hours, they dumped LSASS credentials and soon used a cracked domain administrator account for lateral movement.
Sophos observed a Conti affiliate gain initial access by exploiting ProxyShell vulnerabilities on an on-premises Microsoft Exchange Server 2016 system that was running an outdated cumulative update. The attackers established an initial remote web shell in under one minute and a backup web shell three minutes later.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and industry reporting described multi-stage intrusions in which ransomware and extortion actors gained access through **unpatched Microsoft Exchange ProxyShell flaws**, phishing, compromised credentials, and exposed **RDP** services. Truesec documented attacks where ProxyShell-compromised Exchange servers were used to hijack existing email threads and deliver **Datoploader/Squirrelwaffle** and **QBot**, after which a likely Conti-affiliated actor used **Cobalt Strike**, **RDP**, and privilege escalation to move laterally, enumerate Active Directory, exfiltrate sensitive data, delete backups, and deploy **Conti ransomware**. A recurring artifact in the phishing stage was the Exchange `MessageClass` value `IPM.Blabla`, and infected hosts created `C:\Datop` before executing payloads with `regsvr32.exe` and persistence via registry autoruns or scheduled tasks.
Aug 15, 2026
Attackers actively exploited the **ProxyShell** chain in unpatched on-premises Microsoft Exchange servers to gain remote code execution, plant web shells, and establish persistent access, with incidents linked to **LockFile** ransomware deployment. The intrusion path combined `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` to bypass authentication, escalate privileges, and execute code through exposed Exchange services, while broad internet scanning targeted Exchange Client Access Service instances over IIS. Reporting also warned that applying Exchange updates blocks new exploitation but does not remove web shells or other attacker footholds already left behind on compromised servers. Post-compromise activity included PowerShell-based payload delivery, Cobalt Strike deployment, privilege escalation, and in some cases abuse of **PetitPotam** (`CVE-2021-36942`) for NTLM relay and deeper domain compromise. Researchers described attackers using Exchange web shells, suspicious `.aspx` files, `w3wp.exe` child processes, mailbox export abuse, scheduled tasks, and Active Directory Group Policy plus the `NETLOGON` share to spread ransomware across enterprise environments, turning an initial Exchange breach into domain-wide encryption.
Aug 26, 2026
Threat actors used unpatched **Microsoft Exchange** servers as an initial access point to deploy both **Babuk** and **Cuba** ransomware, with campaigns heavily affecting organizations in the United States and additional victims in other countries. Cisco Talos reported that a newer actor it tracks as **Tortilla** likely exploited **ProxyShell** to compromise Exchange, install the **China Chopper** web shell, stage payloads with PowerShell, and ultimately launch Babuk ransomware that appended the `.babyk` extension after disabling backup-related services and deleting VSS snapshots. A separate intrusion set tied to **Cuba ransomware** also abused Exchange flaws, including **ProxyShell** and **ProxyLogon**, to breach corporate networks and deploy ransomware at scale. Mandiant said the actors, tracked as **UNC2596** and associated with **COLDDRAW**, combined public Exchange exploitation with tools such as **Bughatch**, **Wedgecut**, **Burntcigar**, and **Termite** to maintain persistence, escalate privileges, move laterally, and disable defenses; the activity followed earlier FBI reporting that Cuba had compromised dozens of U.S. critical infrastructure organizations, underscoring the continued risk from internet-exposed, unpatched Exchange servers.
Sep 3, 2026