ProxyLogon and ProxyShell Exploited to Steal Government Emails Across Four Countries
Summary
Hunt researchers found scripts exploiting ProxyLogon and ProxyShell to target government mail systems in Afghanistan, Laos, Georgia, and Argentina. An exposed server held thousands of files, including stolen emails and targeting scripts.
Key points
- An exposed directory on a server hosted on DigitalOcean contained 3,923 files and was accessible for less than 12 hours after researchers detected it.
- Researchers found Python scripts using publicly available ProxyLogon exploit code to access, search, and download Exchange mailbox contents.
- The files indicated targeting of government entities in Afghanistan, Laos, Georgia, and Argentina, including presidential, investigative, statistical, and military offices.
- The Afghanistan folders contained hundreds of email conversations, including communications associated with defense, interior, and protocol officials.
- The age of some emails and the presence of recent communications led researchers to assess that the actor may have maintained access to targeted mail servers.
- The server also exposed an Acunetix scanner instance; shared certificate data suggested possible infrastructure links, but researchers said further analysis was needed.
- The findings underscore that attackers continue to exploit older, unpatched Exchange vulnerabilities.
Article Details
- Attack Vectors
- Exploitation of ProxyLogon and ProxyShell vulnerabilities in Microsoft Exchange servers to access mailboxes and execute commands without authentication.
- Use of copied open-source exploit code in Python scripts to search for and download email communications.
- Defensive Notes
- Apply diligent patch management to prevent exploitation of older vulnerabilities.
- Investigate exposed open directories and review Exchange servers for signs of unauthorized mailbox access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 016344d35f6f217f9f8b483dacb8154b45139355bcc45a3f94910351b5df42b5 | SHA-256 hash of the attacker-related run.py script. |
| SHA256 | 4ad4d5edd434f8269cdf5511667364962dff7f2535ae13cd8102c6acde061a19 | SHA-256 hash of the attacker-related bp.py script. |
| SHA256 | 934e9336d45771a74de544be31e3dc8ec624891c5fc95a36d9ec124b39c4e5c7 | SHA-256 hash of the attacker-related burp.py script. |
| SHA256 | f527ea33f22293d99a5687fc13595c84830d6f2c52add1f08e49fbf607458251 | SHA-256 hash of the attacker-related fuzz.py script. |
MITRE ATT&CK
T1114.002 · Remote Email CollectionThe exploit code accesses mailboxes, searches email, and downloads communications from targeted Exchange servers.T1190 · Exploit Public-Facing ApplicationThe scripts exploit ProxyLogon and ProxyShell vulnerabilities in exposed Exchange servers to gain initial access.
CVE
CVE-2021-31207ProxyShell consists of three vulnerabilities (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207). Successful exploitation allows an unauthenticated attacker to execute commands on the server via port 443. At a highCVE-2021-34473ProxyShell consists of three vulnerabilities (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207). Successful exploitation allows an unauthenticated attacker to execute commands on the server via port 443. At a highCVE-2021-34523ProxyShell consists of three vulnerabilities (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207). Successful exploitation allows an unauthenticated attacker to execute commands on the server via port 443. At a high
Malware
Cobalt Strikeloader utilized the same exploit code seen in Figure 4 to distribute malicious spam, resulting in Cobalt Strike or Qbot infections.Qbotthe same exploit code seen in Figure 4 to distribute malicious spam, resulting in Cobalt Strike or Qbot infections.Squirrelwafflefrom exchange_ssrf_attacks.py (Source: GitHub)In late 2021, TrendMicro highlighted a loader named "Squirrelwaffle," a term introduced by Talos Intelligence. This loader utilized the same exploit code seen in Figure
Products
Tools
Acunetix Web Vulnerability ScannerAnalyzing the other ports on the server, we noticed that an instance of the Acunetix Web Vulnerability Scanner was also present on port 13443, with a certificate bearing a unique common name. Figure 5 illustrates theexchange_ssrf_attacks.pyFigure 4: Code from exchange_ssrf_attacks.py (Source: GitHub)In late 2021, TrendMicro highlighted a loader named "Squirrelwaffle," a term introduced by Talos Intelligence. This loader utilized the same exploit code seen
Countries
Afghanistansectors. For example, we found numerous folders named after email addresses associated with the Afghanistan Arg (Presidential Palace), and within those folders were hundreds of conversations between officials,ArgentinaArgentinaGeorgiaGeorgia (country)LaosWe identified the folder labeled “La” as having a similar number of files and standing for Laos. The actor(s) have organized some of the folders by the countries targeted. We are unsure if this directory is used to
Industries
GovernmentAffected entities were spread across multiple regions, encompassing a seemingly targeted range of government sectors. For example, we found numerous folders named after email addresses associated with the AfghanistanMilitaryThe domain "cge.mil_ar" represents "Estado Mayor General del Ejército," highlighting a targeted attempt to infiltrate Argentina's military leadership's communication channels.