Ransomwarehigh
Play ransomware attacks use a new exploit to bypass ProxyNotShell mitigations on Exchange servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2022-41040+1 related CVE | Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell) | 8.8 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-41080 | Microsoft Exchange Server Privilege Escalation Exploited in Ransomware Campaigns | 8.8 | 77% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | screenconnect.com | n Connect, ID: b81d2f07c9163bf5, URL: instance-cmjrni-relay.screenconnect[.]com – Deployed Mimikatz Crawled and saved their tools, you ca |
| ipv4 | 179.60.149.28 | an open repository and shared it through a MegaUpload link. 179.60.149.28 – Initial access #ProxyNotShell – Bitsadmin to download too |
From the original article
2 min read at securityaffairs.com
Play ransomware attacks target Exchange servers with a new exploit that bypasses Microsoft’s ProxyNotShell mitigations. Play ransomware operators target Exchange servers using a new exploit chain, dubbed OWASSRF by Crowdstrike, that bypasses Microsoft’s mitigations for ProxyNotShell vulnerabilities. CVE-2022-41040 – Microsoft Exchange Server Elevation of Privilege Vulnerability
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.