Huntress Details Widespread Exploitation of On-Premises Exchange Servers

Summary

Huntress reported widespread exploitation of on-premises Exchange flaws, finding 350+ webshells across roughly 3,000 servers. Its analysis traced multi-stage PowerShell payloads, persistence, and suspected Mimikatz activity; Microsoft had issued emergency patches.

Key points

Huntress reported finding more than 350 webshells while monitoring roughly 3,000 vulnerable Exchange servers; about 800 of the servers it could see remained unpatched at the time of an update.
The vulnerabilities affected on-premises Exchange Server 2010–2019; Exchange Online was not affected. The article lists CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065.
The webshells included China Chopper variants, which could execute code supplied through HTTP requests.
Huntress traced staged PowerShell payloads that gathered host information and set up scheduled-task persistence; a later payload contacted an external server.
Huntress observed a Winnet persistent service on five compromised servers and reported DLL evidence suggesting Mimikatz use and Chrome credential theft, while noting its analysis was ongoing.
The researchers urged organizations to patch promptly, verify the running Exchange service version, and hunt for webshells and other indicators; Huntress also said it was detecting webshells and sending incident reports.

Article Details

Attack Vectors: Attackers exploited zero-day vulnerabilities in publicly accessible, on-premises Microsoft Exchange servers to achieve remote code execution.
The attackers deployed China Chopper webshells, which execute code supplied through an HTTP request argument.
A PowerShell payload downloaded and executed additional code from external servers. Later stages used Base64 decoding, decompression, obfuscation, and scheduled tasks for persistence and recurring execution.
Later-stage payloads were reported to collect information from compromised hosts and send it to an external server; analysis also found code invoking Mimikatz and attempting to dump Google Chrome credentials.
Defensive Notes: Immediately patch on-premises Exchange servers and externally verify patch status; the article recommends checking the exact version of the running Microsoft.Exchange.RpcClientAccess.Service.exe binary against Microsoft's version guidance.
Hunt for webshells and other indicators of compromise, including in C:\inetpub\wwwroot\aspnet_client\system_web; the article notes that this path can be redirected through the PathWWWRoot registry value.
Use Microsoft's official Nmap NSE script to identify vulnerable systems and validate patching; the article says the earlier community script and registry-version checks were not reliable.
Monitor for existing and newly dropped webshells, PowerShell activity, scheduled-task persistence, and follow-on payload execution. The article cautions that the Huntress agent alone does not establish patch status.

Indicators of compromise

Type	Indicator	Context
URL	`hxxp[:]//188[.]166[.]162[.]201/update.png`	URL receiving information gathered from a compromised host and returning a further payload.
URL	`hxxp[:]//cdn[.]chatcdn[.]net/p?hig210305`	URL serving a recurring obfuscated payload to compromised hosts at high integrity.
URL	`hxxp[:]//cdn[.]chatcdn[.]net/p?low210305`	URL serving a recurring obfuscated payload to compromised hosts at medium integrity.
URL	`hxxp[:]//p[.]estonine[.]com/p?e`	URL used by a PowerShell download cradle to retrieve a stager during post-exploitation.