Sophos: How timely intervention stopped a ProxyLogon attack
A recent incident at an undisclosed customer sheds new light on how malicious actors exploit unpatched Microsoft Exchange servers
Share this item with your network:
By
Published: 05 May 2021 14:00
Cyber security researchers at Sophos have been sharing details of how they were able to cut off an ongoing cyber attack on one of their customers, which exploited the dangerous ProxyLogon vulnerabilities in on-premise instances of Microsoft Exchange Server.
The customer, whose identity has not been revealed, is a large North American organisation with about 15,000 endpoints in play. It was initially compromised on 16 March 2021, a couple of weeks after the ProxyLogon zero-days were disclosed, via CVE-2021-26855 and CVE-2021-27065, which were leveraged to execute a malicious PowerShell command on the vulnerable server.