Loading story…
Black Kingdom ransomware was deployed against unpatched on-premises Microsoft Exchange servers after attackers exploited the ProxyLogon chain, particularly CVE-2021-27065, and installed web shells for remote access. Reporting from multiple security firms says the operators used shells including ChackLogsPL.aspx, ckPassPL.aspx, hackIdIO.aspx, and in some cases China Chopper, then launched the payload through PowerShell, WMI, and downloads from infrastructure such as yuuuuu44[.]com. Trend Micro also linked ProxyLogon exploitation to other malware families including LemonDuck and Prometei, showing that Exchange compromises quickly became a shared delivery path for ransomware, coinminers, and botnets.
Researchers described Black Kingdom as a relatively crude Python ransomware built with PyInstaller, but still disruptive: it encrypted files, could encrypt them multiple times, stopped SQL-related services, deleted Windows Event Logs, and displayed a ransom note demanding $10,000 in Bitcoin. Analysis found the malware uploaded victim IDs and encryption keys to Mega, but fell back to a hardcoded key if that failed, creating a significant cryptographic weakness that may allow recovery in some cases. Additional reporting tied the campaign to random encrypted-file extensions, shared payment infrastructure, possible data-theft extortion claims, and at least one likely ransom payment, while analysts assessed the Exchange attacks as largely opportunistic rather than confidently attributable to a known threat actor.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
Sophos telemetry began detecting Black KingDom activity on vulnerable on-premises Microsoft Exchange servers on March 18. The attacks exploited ProxyLogon CVE-2021-27065, deployed webshells, and launched ransomware via PowerShell and WMI.
Trend Micro telemetry showed the Prometei botnet exploiting ProxyLogon after BlackKingdom. The report linked both BlackKingdom and Prometei to similar post-exploitation behavior such as use of ExchDefender.exe and the fake MSExchangeDefenderPL service.
Trend Micro reported that BlackKingdom began exploiting ProxyLogon shortly after LemonDuck. In these intrusions, attackers used China Chopper web shells on compromised Exchange servers and post-exploitation tooling including ExchDefender.exe.
Trend Micro telemetry showed LemonDuck exploiting ProxyLogon beginning in March 2021. The activity preceded BlackKingdom and Prometei exploitation in the same broader wave.
Securelist reported renewed Black Kingdom activity in 2021 tied to exploitation of Microsoft Exchange ProxyLogon vulnerabilities, particularly CVE-2021-27065. The report described opportunistic deployment after webshell installation and highlighted a hardcoded fallback key weakness that could enable file recovery.
Trend Micro stated that the Microsoft Exchange ProxyLogon vulnerability set was discovered in late 2020. These zero-days later enabled attacks on unpatched Exchange servers.
Securelist noted that Black Kingdom was also observed in 2020 following exploitation of the Pulse Secure vulnerability CVE-2019-11510. This shows the ransomware was used before the later Exchange-focused activity.
Securelist reported that the Black Kingdom ransomware family was first seen in 2019. The malware was characterized as a Python-based ransomware later reused in subsequent campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
id-ransomware.blogspot.com
Open sourcenews.sophos.com
Open sourcenews.sophos.com
Open sourcesecurelist.com
Open sourcetrendmicro.com
Open sourceproxylogon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited the **ProxyShell** chain in unpatched on-premises Microsoft Exchange servers to gain remote code execution, plant web shells, and establish persistent access, with incidents linked to **LockFile** ransomware deployment. The intrusion path combined `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` to bypass authentication, escalate privileges, and execute code through exposed Exchange services, while broad internet scanning targeted Exchange Client Access Service instances over IIS. Reporting also warned that applying Exchange updates blocks new exploitation but does not remove web shells or other attacker footholds already left behind on compromised servers. Post-compromise activity included PowerShell-based payload delivery, Cobalt Strike deployment, privilege escalation, and in some cases abuse of **PetitPotam** (`CVE-2021-36942`) for NTLM relay and deeper domain compromise. Researchers described attackers using Exchange web shells, suspicious `.aspx` files, `w3wp.exe` child processes, mailbox export abuse, scheduled tasks, and Active Directory Group Policy plus the `NETLOGON` share to spread ransomware across enterprise environments, turning an initial Exchange breach into domain-wide encryption.
Aug 26, 2026
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.
Aug 15, 2026
Threat actors used unpatched **Microsoft Exchange** servers as an initial access point to deploy both **Babuk** and **Cuba** ransomware, with campaigns heavily affecting organizations in the United States and additional victims in other countries. Cisco Talos reported that a newer actor it tracks as **Tortilla** likely exploited **ProxyShell** to compromise Exchange, install the **China Chopper** web shell, stage payloads with PowerShell, and ultimately launch Babuk ransomware that appended the `.babyk` extension after disabling backup-related services and deleting VSS snapshots. A separate intrusion set tied to **Cuba ransomware** also abused Exchange flaws, including **ProxyShell** and **ProxyLogon**, to breach corporate networks and deploy ransomware at scale. Mandiant said the actors, tracked as **UNC2596** and associated with **COLDDRAW**, combined public Exchange exploitation with tools such as **Bughatch**, **Wedgecut**, **Burntcigar**, and **Termite** to maintain persistence, escalate privileges, move laterally, and disable defenses; the activity followed earlier FBI reporting that Cuba had compromised dozens of U.S. critical infrastructure organizations, underscoring the continued risk from internet-exposed, unpatched Exchange servers.
Sep 3, 2026