Loading story…
Attackers actively exploited the Microsoft Exchange Server vulnerabilities CVE-2022-41040 and CVE-2022-41082, widely known as ProxyNotShell, to gain remote code execution on vulnerable on-premises deployments. Microsoft disclosed the attacks and analyzed the exploit chain, which abuses the two flaws together, while affected products included supported Exchange Server 2013, 2016, and 2019 cumulative update versions; Exchange Online was not affected.
Security monitoring in the weeks after disclosure showed sustained scanning and exploitation attempts, with one SOC reporting activity beginning on October 3 and continuing intermittently through November, and more than 90% of observed source countries tied to the United States. Many requests appeared to use the ZGrab scanning tool based on User-Agent headers, and public proof-of-concept code increased the likelihood of continued abuse. Microsoft released patches for affected Exchange versions, and organizations running on-premises Exchange were urged to apply the vendor fixes without delay.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC reported increased attack activity during November 2022 targeting the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082. It said detections continued intermittently after the initial October observations, with more than 90% of observed source countries identified as the United States.
MBSD-SOC reported first observing attacks targeting CVE-2022-41040 and CVE-2022-41082 on October 3, 2022. The observed requests targeted Exchange autodiscover paths and many appeared to use the ZGrab scanning tool.
Microsoft publicly disclosed CVE-2022-41040 and CVE-2022-41082 affecting on-premises Microsoft Exchange Server. The chained vulnerabilities, later widely referred to as ProxyNotShell, can enable remote code execution.
Microsoft released remediated versions for affected Exchange Server 2013, 2016, and 2019 cumulative update branches. The fixes addressed the on-premises products listed as affected, while Exchange Online was noted as unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
mbsd.jp
Open sourcemicrosoft.com
Open sourcemsrc-blog.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited the **ProxyNotShell** chain on on-premises Microsoft Exchange Server by combining `CVE-2022-41040`, an authenticated SSRF flaw, with `CVE-2022-41082`, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server **2013, 2016, and 2019** were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused `WSMAN` and XML SOAP traffic to establish remote shell access. Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including `193.149.185.52:443` and `sync.service.auzreservices.com`, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Jun 29, 2026
Microsoft warned that attackers were actively exploiting a zero-day chain in on-premises Microsoft Exchange Server, later tracked as **ProxyNotShell** and assigned `CVE-2022-41040` and `CVE-2022-41082`. The flaws affected Exchange Server 2013, 2016, and 2019, while **Exchange Online was not affected**. The attack chain used a server-side request forgery (**SSRF**) bug to reach PowerShell remoting and achieve remote code execution, and reports indicated the activity required valid email credentials from a non-admin user. Microsoft and security researchers urged organizations to apply interim protections immediately, including an **IIS URL Rewrite** rule to block known exploit paths and restricting or disabling **Remote PowerShell** where possible. Guidance also highlighted the need to review IIS logs and related telemetry for signs of compromise, as the campaign was reportedly already being used in real-world attacks and drew comparisons to the earlier **ProxyShell** exploitation wave.
Aug 6, 2026
Researchers detailed **ProxyShell**, a chain of Microsoft Exchange vulnerabilities that can be combined to bypass authentication, escalate privileges, and achieve remote code execution on exposed Exchange servers. Orange Tsai described the attack surface and showed how flaws including `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` could be chained to reach backend Exchange services and execute attacker-controlled code without valid credentials. Mandiant later reported real-world exploitation of ProxyShell against internet-facing Exchange environments, showing that attackers used the chain to gain shells on compromised servers and establish persistent access. The reporting underscores that unpatched on-premises Exchange systems remained a high-value target because successful exploitation could hand attackers direct control of email infrastructure, enable follow-on intrusion activity, and expose sensitive enterprise communications.
Jul 12, 2026