Loading story…
At least 10 advanced persistent threat groups exploited the ProxyLogon vulnerabilities in on-premises Microsoft Exchange Server, with several attacking before Microsoft released emergency patches on March 2, 2021. The flaws affected Exchange Server 2013, 2016 and 2019 and enabled a pre-authentication remote-code-execution chain used to access email, install web shells and deploy additional malware. Microsoft initially attributed zero-day activity to HAFNIUM; ESET subsequently detected web shells on more than 5,000 email servers across over 115 countries, with government agencies and private companies among the victims. Other observed attackers included Tick, LuckyMouse, Calypso, Winnti Group, CactusPete and Mikroceen.
Exploitation expanded beyond the initial espionage campaigns. FamousSparrow began exploiting ProxyLogon the day after patches were released and used its SparrowDoor backdoor in campaigns targeting hotels, governments and other organizations. The financially motivated Prometei botnet exploited CVE-2021-26858 and CVE-2021-27065 to deploy China Chopper web shells and download malware for Monero mining, credential harvesting and lateral propagation; its backdoor capabilities also created risks of data theft and further malware delivery. Defenders were urged to patch exposed Exchange servers and investigate existing compromises: patching alone does not remove attacker access, making web-shell detection, persistence hunting and remediation essential.
See which actors are running it and whether you're in range.
18 events from the most recent confirmed update back to the earliest known activity.
ESET telemetry showed that FamousSparrow began exploiting ProxyLogon the day after Microsoft's March 2021 patch release. The group used the Exchange vulnerabilities to deploy its custom SparrowDoor backdoor.
Mikroceen, also known as Vicious Panda, compromised a Central Asian utility company's Exchange server one day after Microsoft released patches.
Microsoft released out-of-band security updates for on-premises Exchange Server 2013, 2016 and 2019 and disclosed active exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. Microsoft attributed observed attacks involving email access, data theft and persistent malware installation to HAFNIUM.
Winnti Group compromised email servers at an oil company and a construction equipment company hours before Microsoft's patch release. The intrusions involved webshells, PlugX or a loader resembling previous Winnti v.4 loaders, along with credential-dumping tools.
LuckyMouse compromised the server one day before Microsoft released patches. The attackers deployed Nbtscan and a ReGeorg webshell variant and attempted to install the SysUpdate backdoor.
ESET observed Tick exploitation beginning February 28, two days before Microsoft's patch release. Tick compromised an East Asian IT company's webserver and deployed a Delphi backdoor resembling its previous implants.
Researchers first discovered Prometei in 2020. The multi-stage botnet targets Windows and Linux systems to mine Monero and uses credential harvesting and lateral propagation techniques.
ESET traced FamousSparrow's campaigns back to August 2019. The group primarily targeted hotels, but also attacked governments, international organizations, engineering companies and law firms.
Microsoft released security updates for CVE-2021-28480, CVE-2021-28481, CVE-2021-28482 and CVE-2021-28483, four critical remote code execution vulnerabilities distinct from the March flaws. Microsoft reported no observed exploitation at release; systems already patched in March still required these updates.
ESET named FamousSparrow as a cyberespionage group and documented targets in 12 countries, linking its activity to the custom SparrowDoor backdoor. The analysis detailed DLL search-order hijacking, registry and service persistence, file exfiltration and an interactive reverse shell.
Cybereason identified an opportunistic Prometei campaign using CVE-2021-26858 and CVE-2021-27065 to install China Chopper, which launched PowerShell to download the botnet payload. Targets included banking, insurance, retail and construction organizations across the United States, South America, Europe and East Asia.
ESET identified at least 10 APT groups exploiting the Exchange vulnerabilities and detected webshells on more than 5,000 email servers across more than 115 countries. Its investigation also found overlapping targeting and webshells accessed by multiple groups, suggesting some attackers may have hijacked existing footholds.
ESET identified an activity cluster targeting approximately 650 servers with a first-stage webshell named RedirSuiteServerProxy. Targets were predominantly in Germany, other European countries, the United Kingdom and the United States.
An unattributed activity cluster compromised email servers at an East Asian software development company and a Middle Eastern real estate company. The attackers deployed ShadowPad, which supports remote control, keylogging and data exfiltration.
After patches were released, attackers used webshells to install IIS backdoors on four email servers in Asia and South America.
After patch release and public disclosure, CactusPete compromised email servers at an Eastern European procurement company and a cybersecurity consulting company. The attacks deployed a ShadowPad loader and a Bisonal remote-access trojan variant.
ESET identified a pre-patch activity cluster named Websiic targeting seven email servers. Victims included Asian IT, telecommunications and engineering companies and an Eastern European government body.
Calypso compromised government email servers in the Middle East and South America before patches were released, then targeted government entities and private companies across Africa, Asia and Europe. The group deployed a PlugX variant and the Whitebird backdoor using DLL search-order hijacking.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
threatpost.com
Open sourcesocprime.com
Open sourcethreatpost.com
Open sourcereliaquest.com
Open sourcecyber.gc.ca
Open sourcedomaintools.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched four actively exploited on-premises Exchange Server vulnerabilities — `CVE-2021-26855`, `CVE-2021-26857`, `CVE-2021-26858`, and `CVE-2021-27065` — after investigators linked the initial intrusion wave to the China-linked **HAFNIUM** group. The flaws, later widely known as **ProxyLogon**, affected Exchange Server 2013, 2016, and 2019, with a defense-in-depth update also issued for Exchange 2010. Researchers said exploitation had begun by early January and rapidly expanded after public disclosure, with multiple threat actors using the bugs to gain remote access, drop **web shells** including **China Chopper** variants, steal email and files, dump credentials, and move laterally across victim networks. Security agencies and vendors warned that patching alone did not remove attacker access because many servers had already been backdoored, prompting urgent guidance to review Exchange `HttpProxy` and IIS logs, hunt for suspicious `w3wp.exe` child processes, PowerShell abuse, LSASS dumping, and unauthorized admin creation. The campaign hit organizations globally, including Norway’s parliament, and U.S. authorities later obtained court approval for an FBI operation that removed malicious web shells from hundreds of vulnerable U.S.-based Exchange servers. Microsoft, CISA, the FBI, and incident responders urged defenders to patch immediately, restrict exposure where possible, and conduct full compromise assessments because mass exploitation continued well beyond the initial disclosure.
Sep 3, 2026
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026
Attackers actively exploited the Microsoft Exchange Server vulnerabilities **CVE-2022-41040** and **CVE-2022-41082**, widely known as **ProxyNotShell**, to gain remote code execution on vulnerable on-premises deployments. Microsoft disclosed the attacks and analyzed the exploit chain, which abuses the two flaws together, while affected products included supported **Exchange Server 2013, 2016, and 2019** cumulative update versions; **Exchange Online** was not affected. Security monitoring in the weeks after disclosure showed sustained scanning and exploitation attempts, with one SOC reporting activity beginning on October 3 and continuing intermittently through November, and more than 90% of observed source countries tied to the United States. Many requests appeared to use the **ZGrab** scanning tool based on `User-Agent` headers, and public proof-of-concept code increased the likelihood of continued abuse. Microsoft released patches for affected Exchange versions, and organizations running on-premises Exchange were urged to apply the vendor fixes without delay.
Aug 15, 2026