Microsoft Exchange servers got hacked to deploy BlackByte ransomware

In a detailed report by Red Canary, researchers analyzed a BlackByte ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.

 

ProxyShell is a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.

 

Web Shells allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.

 

The planted web shell is then utilized to drop a Cobalt Strike beacon on the server, injected into the Windows Update Agent process. The widely abused penetration testing tool is then used for dumping credentials for a service account on the compromised system. Finally, after taking over the account, the adversaries install the AnyDesk remote access tool and then proceed to the lateral movement stage.