Proxylogon

ProxyLogon is a significant software vulnerability, specifically a server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server. Identified as CVE-2021-26855, it forms part of the ProxyLogon exploit chain and allows attackers to bypass authentication mechanisms and impersonate users. This flaw, along with another known as ProxyShell (CVE-2021-34473), has been widely exploited by threat actors, including Advanced Persistent Threat (APT) groups reportedly backed by China. These vulnerabilities have been used to compromise nodes and steal geopolitical secrets from various regions, including the Middle East, Africa, and Asia. These vulnerabilities were made public in February 2021, following which there was a notable increase in attacks exploiting them. In some instances, these flaws were used to deploy web shells on compromised Microsoft Exchange servers. The FBI intervened in several cases, receiving court approval to remove Russian Snake data theft malware, Emotet malware, and web shells from infected devices, without notifying the owners. It's conjectured that some threat actors might have been targeting the ProxyLogon vulnerabilities even before their public disclosure, although evidence for this remains inconclusive. To mitigate the risks associated with ProxyLogon and ProxyShell, organizations are advised to use Anti-Exploitation modules and Behavioral Threat Protection. Such measures can help protect against exploitation of these and other vulnerabilities. Cortex XSIAM is one such tool providing anti-exploit protection. Furthermore, organizations are encouraged to harden and patch sensitive internet-facing assets regularly, given the threat actor’s repeated use of Exchange server exploits for initial access.