RansomwarecriticalExploited in the wild

Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations

The Hacker Newsby @TheHackersNewsDec 22, 2022 · 03:36 UTC (Dec 22, 2022)2 min read1

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-41040 CVE-2022-41080 CVE-2022-41082

Tags: cve-2022-41040 cve-2022-41080 cve-2022-41082 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2022-41040 +1 related CVE CVE-2022-41082	Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell)	8.8 group max	100%	KEVRansomwarePoC	Oct 3, 2022 KEV Sep 30, 2022
CVE-2022-41080	Microsoft Exchange Server Privilege Escalation Exploited in Ransomware Campaigns	8.8	77%	KEVRansomware	Nov 9, 2022 KEV Jan 10, 2023

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Dec 21, 2022 Email Security / Data Security Threat actors affiliated with a ransomware strain known as Play are leveraging a never-before-seen exploit chain that bypasses blocking rules for ProxyNotShell flaws in Microsoft Exchange Server to achieve remote code execution (RCE) through Outlook Web Access ( OWA ).

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.