Loading story…
Security researchers detailed how Microsoft Exchange web interfaces can be abused to extract broad Active Directory data by leveraging Exchange-exposed RPC functionality, turning an Internet-facing mail server into a proxy for directory reconnaissance. The research reviewed earlier Exchange attack paths involving Autodiscover, Offline Address Books, EWS, PrivExchange, and Office Web Add-ins, then highlighted RPC over HTTP v2 as a more flexible technique that can work with any domain account without requiring mailbox access or Autodiscover.
The attack abuses Exchange support for the MS-OXABREF and MS-OXNSPI protocols to enumerate address books and query directory information that Exchange can see, including Domain Controller Distinguished Name Tags that enable large-scale Active Directory record dumping. Researchers also tied Exchange abuse to escalation paths that can put attackers one API call away from domain administrator privileges, and released tooling improvements in Impacket such as rpcmap.py enhancements and a new exchanger.py utility; they warned organizations not to expose Exchange directly to the Internet and recommended restricting access with VPNs or client certificates.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
The research operationalized the technique by adding RPC over HTTP v2 enumeration capabilities to rpcmap.py and creating a new exchanger.py utility, which the article says was later made available in the Impacket repository.
Positive Technologies published research showing that Exchange-exposed RPC over HTTP v2 can be abused to access MS-OXABREF and MS-OXNSPI, allowing low-privilege accounts, including accounts without mailboxes, to enumerate address books and retrieve broad Active Directory data through Exchange.
The Positive Technologies article states that Dirk-jan Mollema released PrivExchange along with an NTLMRelayX update to relay Exchange-originated HTTP authentication to LDAP for Active Directory write access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited unpatched on-premises Microsoft Exchange servers vulnerable to **ProxyShell** to gain initial access, deploy web shells and malicious .NET payloads, and abuse the compromised mail environment. In one intrusion, the Exchange server was used to send phishing replies from hijacked legitimate email threads to internal and external recipients, delivering **DatopLoader** followed by **QBot**; the activity then expanded into reconnaissance, persistence, command-and-control traffic, credential theft via registry hive dumping, and lateral movement with **Cobalt Strike** across the victim domain. Separate analysis of ProxyShell post-exploitation found threat actors loading DLLs in memory from Exchange web processes, enumerating Exchange and Active Directory assets, testing domain controllers for **Zerologon**, extracting hashed credentials, and using pass-the-hash for persistence. One payload, `Thor.dll`, created domain accounts disguised as **healthmailbox** users and granted them the **ApplicationImpersonation** role, allowing covert access to and sending of email from any mailbox in the organization, underscoring how Exchange compromise can be turned into both malware delivery and long-term mailbox takeover.
Aug 14, 2026
Attackers actively exploited the **ProxyShell** chain in unpatched on-premises Microsoft Exchange servers to gain remote code execution, plant web shells, and establish persistent access, with incidents linked to **LockFile** ransomware deployment. The intrusion path combined `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` to bypass authentication, escalate privileges, and execute code through exposed Exchange services, while broad internet scanning targeted Exchange Client Access Service instances over IIS. Reporting also warned that applying Exchange updates blocks new exploitation but does not remove web shells or other attacker footholds already left behind on compromised servers. Post-compromise activity included PowerShell-based payload delivery, Cobalt Strike deployment, privilege escalation, and in some cases abuse of **PetitPotam** (`CVE-2021-36942`) for NTLM relay and deeper domain compromise. Researchers described attackers using Exchange web shells, suspicious `.aspx` files, `w3wp.exe` child processes, mailbox export abuse, scheduled tasks, and Active Directory Group Policy plus the `NETLOGON` share to spread ransomware across enterprise environments, turning an initial Exchange breach into domain-wide encryption.
Aug 26, 2026
Researchers detailed **ProxyShell**, a chain of Microsoft Exchange vulnerabilities that can be combined to bypass authentication, escalate privileges, and achieve remote code execution on exposed Exchange servers. Orange Tsai described the attack surface and showed how flaws including `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` could be chained to reach backend Exchange services and execute attacker-controlled code without valid credentials. Mandiant later reported real-world exploitation of ProxyShell against internet-facing Exchange environments, showing that attackers used the chain to gain shells on compromised servers and establish persistent access. The reporting underscores that unpatched on-premises Exchange systems remained a high-value target because successful exploitation could hand attackers direct control of email infrastructure, enable follow-on intrusion activity, and expose sensitive enterprise communications.
Jul 12, 2026