Everything you need to know about ProxyShell vulnerabilities

1. Hackers create web shells

A web shell is essentially a command line interface that can be used to attack a vulnerable system. The ProxyShell exploits enable remote PowerShell sessions to be established with vulnerable Exchange Servers. There are several ways that attackers have used PowerShell to create web shells.

One of the best-known web shell exploits involves an attacker creating a draft e-mail message within an Exchange mailbox. This draft message contains a special attachment -- a file with an ASPX extension. Once this email message is created, the attacker uses the New-MailboxExportRequest cmdlet to export the mailbox contents to a PST file. This export process causes the message attachment to be decoded, allowing the attachment to be executed.

2. Hackers use ProxyShell as a tool to plant ransomware

In August and September 2021, there were a number of documented instances of attackers using the ProxyShell vulnerabilities to plant LockFile ransomware on unpatched Microsoft Exchange systems.  More recently, Babuk ransomware has been showing up on unpatched Exchange Servers. Squirrelwaffle has also been exploiting ProxyShell. Squirrelwaffle is malware that formulates malicious responses to legitimate email chains.

The most important thing to keep in mind about these types of ransomware and malware attacks is that they are not caused by a user who accidentally clicks on something that they shouldn't. Hackers are actively looking for unpatched Exchange Servers and planting malware and ransomware on those servers.

Learn about the decryptors Avast developed to recover data from LockFile, Babuk and AtomSilo ransomware variants.

Businesses affected

As of August 2021, more than 1,900 Exchange Servers were known to have been hacked. The types of organizations affected by ProxyShell attacks include building manufacturing, seafood processors, industrial machinery, auto repair shops, a small residential airport and more, according to a tweet from Kyle Hanslovan, CEO of Huntress Labs.

How to protect against ProxyShell vulnerabilities

The first thing that organizations need to do to protect themselves from ProxyShell vulnerabilities is patch their on-premises Microsoft Exchange Servers. Specifically, organizations need to deploy the latest cumulative update, plus either the May 2021 security updates or the July 2021 security updates. The cumulative update and the security update are both necessary to be protected. Exchange Server versions older than Exchange 2013 could be vulnerable regardless of whether or not they are patched.

In addition to patching any on-premises Exchange Servers, organizations also need to perform a comprehensive malware scan and security scan to determine if Exchange Servers have already been compromised. If an attacker has installed a web shell onto an Exchange Server, threat actors may be able to use that web shell to access systems even after they are patched.