Loading story…
Researchers reported intrusions against Middle East government environments that abused unpatched Microsoft collaboration servers to gain long-term access. One campaign documented by Secureworks exploited Microsoft Exchange vulnerability CVE-2020-0688, deploying multiple web shells, reusing compromised administrator credentials, moving between Exchange and SharePoint servers, dumping credentials from a certificate authority server and domain controller, and exfiltrating data through a compromised Exchange host. Secureworks said the activity persisted through at least April 2021 and assessed with moderate confidence that the Exchange-related operation was likely tied to an Iranian threat group, possibly COBALT GYPSY.
The reporting also linked the victim set to earlier exploitation of Microsoft SharePoint. Secureworks found a separate 2019 compromise that abused CVE-2019-0604 on SharePoint and concluded it was likely unrelated to the later Exchange intrusion, indicating different threat actors targeted the same environment over time. Separate reporting from Palo Alto Networks Unit 42 described Emissary Panda attacks against Middle East government SharePoint servers, underscoring how exposed SharePoint and Exchange systems in the region were repeatedly used as entry points for espionage-focused operations.
See the actors and campaigns active against you right now.
12 events from the most recent confirmed update back to the earliest known activity.
Secureworks CTU observed continuation of CVE-2020-0688-related intrusion activity through at least April 2021. The activity may have persisted as late as June 2021.
During an April 2021 threat hunting engagement, Secureworks incident responders found web shells on multiple hosts in a customer environment. They also identified evidence of a previous SharePoint compromise and ongoing activity initially enabled by compromised on-premises Exchange servers.
The attacker uploaded an s.aspx web shell to the same SharePoint servers that had been exploited in April 2019. Secureworks reported that s.aspx had the same functionality as services.aspx.
Using the compromised accounts and hostname, the attacker conducted additional intrusion activity on a critical business server and deployed a web shell named service.aspx, followed by a second web shell named services.aspx. Secureworks found that services.aspx borrowed code from the HighShell and HyperShell web shells associated with COBALT GYPSY.
About three months after the early-2021 Exchange activity, the attacker re-entered the environment using the same hostname and compromised credentials to upload the TransportClient.dll web shell. Secureworks named this IIS-module web shell SheepTransportShell and observed related PowerShell activity creating the splsvc named pipe and, in one variant, a scheduled task named Google Updater.
In early 2021, the same owafont.aspx web shell was installed on other Exchange Servers, likely using the same compromised administrator account. This indicated expansion of the Exchange intrusion within the environment.
Secureworks discovered that a basic file upload and command execution web shell named owafont.aspx was installed on an Exchange Server in late 2020. Initial access to the Exchange environment was likely achieved by exploiting CVE-2020-0688.
Third-party researchers also reported in November 2020 that threat actors were targeting organizations using CVE-2020-0688. The reporting showed continued attacker interest in the Exchange vulnerability later in the year.
Third-party researchers reported in March 2020 that threat actors were targeting organizations via CVE-2020-0688, a remote code execution vulnerability in Microsoft Exchange Server. This established active exploitation of the flaw in the wild.
From June 2019 to June 2020, several C# web shells were installed on the previously compromised SharePoint servers in the same directories as the earlier China Chopper shells. Secureworks found no evidence linking these later C# shells to the earlier SharePoint web shell deployment.
In April 2019, a threat actor compromised several SharePoint servers in the customer environment by exploiting CVE-2019-0604. The intrusion resulted in deployment of multiple web shells, including China Chopper variants.
Secureworks assessed with moderate confidence that the later Exchange-led intrusion was likely conducted by an Iranian threat group, possibly COBALT GYPSY. The firm also assessed that the 2019 SharePoint activity and the later Exchange activity were unrelated and likely conducted by different threat groups.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 50 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
secureworks.com
Open sourcenorfolkinfosec.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026
Microsoft disclosed multiple on-premises SharePoint Server vulnerabilities, including remote code execution flaws `CVE-2025-49701` and `CVE-2025-49704` and spoofing flaw `CVE-2025-49706`, as defenders responded to active exploitation. Microsoft said it was working to disrupt attacks targeting exposed SharePoint environments, while the Canadian Centre for Cyber Security issued threat-detection guidance to help organizations identify compromise tied to the SharePoint vulnerabilities. Subsequent reporting tied the broader **ToolShell** exploitation chain, including `CVE-2025-53770`, to China-linked operators that breached a Middle Eastern telecom provider, government departments in Africa, government agencies in South America, and a U.S. university. Investigators said the intrusions used malware and tooling including **Zingdoor**, **ShadowPad**, **KrustyLoader**, and **Sliver**, alongside credential-dumping, proxying, DLL sideloading, and persistence techniques, indicating a stealthy espionage-focused campaign that expanded beyond initial public understanding of the SharePoint attacks.
Jun 29, 2026
Attackers actively exploited the **ProxyShell** chain in unpatched on-premises Microsoft Exchange servers to gain remote code execution, plant web shells, and establish persistent access, with incidents linked to **LockFile** ransomware deployment. The intrusion path combined `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` to bypass authentication, escalate privileges, and execute code through exposed Exchange services, while broad internet scanning targeted Exchange Client Access Service instances over IIS. Reporting also warned that applying Exchange updates blocks new exploitation but does not remove web shells or other attacker footholds already left behind on compromised servers. Post-compromise activity included PowerShell-based payload delivery, Cobalt Strike deployment, privilege escalation, and in some cases abuse of **PetitPotam** (`CVE-2021-36942`) for NTLM relay and deeper domain compromise. Researchers described attackers using Exchange web shells, suspicious `.aspx` files, `w3wp.exe` child processes, mailbox export abuse, scheduled tasks, and Active Directory Group Policy plus the `NETLOGON` share to spread ransomware across enterprise environments, turning an initial Exchange breach into domain-wide encryption.
Aug 26, 2026