Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ProxyLogon and ProxyShell Used to Target Government Mail Servers in Asia, Europe, and South America

hunt.io | blog | #threat-hunting | #cyber-espionage | #proxylogon | #exchange-server | #proxyshell | #cve-2021-34473

Summary

Hunt.io uncovers a server exploiting ProxyLogon and ProxyShell to loot government Exchange mailboxes—files named for Afghanistan's presidential palace, plus victims in Georgia, Laos and Argentina.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities
This threat intelligence report documents active targeting of critical national infrastructure and defense contractors through edge application vulnerabilities.
blog · hunt.io
DarkPeony’s Trail: Certificate Patterns Point to Sustained Campaign Infrastructure
Hunt.io follows certificate patterns—'AES' organizational units and shared issuers—to extend infrastructure tied to DarkPeony, a Chinese espionage group targeting governments and militaries.
blog · hunt.io
Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit
Hunt.io details a Mustang Panda-linked campaign using the ToneShell backdoor against attendees of the IISS Prague Defence Summit, delivered via a lure executable disguised as summit material.
blog · hunt.io
How We Identify Malicious Infrastructure At Hunt.io
Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.
blog · hunt.io
Introducing the Hunt.io C2 Feed
Hunt announces its C2 Feed, covering how the team identifies and tracks malicious command-and-control servers and packages this intelligence to help defenders block adversary infrastructure.
blog · hunt.io
How Hunt.io Identifies Services on Non-Standard Ports
Hunt explains GPS, its scanning platform that predicts running services across all 65,000 ports from tiny samples, helping it uncover malicious infrastructure hiding on non-standard ports.
back