Proxylogon

ProxyLogon is a serious software vulnerability, specifically an exploit chain in Microsoft Exchange Server. The chain includes CVE-2021-26855, a server-side request forgery (SSRF) vulnerability that allows attackers to bypass authentication and impersonate users, along with other vulnerabilities such as CVE-2021-27065 and CVE-2021-26858. These flaws have been exploited by various threat actors, including Advanced Persistent Threat (APT) groups, to compromise nodes and deploy web shells on Microsoft Exchange servers. ProxyLogon was seen being actively exploited starting in March 2021, targeting various entities worldwide, including hotels, governments, and private companies. The FBI has taken significant action against the exploitation of these vulnerabilities. After receiving court approval, the Bureau removed Russian Snake data theft malware and Emotet malware from infected devices, as well as web shells on Microsoft Exchange servers deployed in ProxyLogon attacks. However, despite these efforts, threat actors continue to target known vulnerabilities. For instance, the APT group was observed repeatedly exploiting the Microsoft Exchange server vulnerabilities known as ProxyLogon and ProxyShell. To protect against exploitation of vulnerabilities like ProxyLogon and ProxyShell, organizations are advised to utilize Anti-Exploitation modules and Behavioral Threat Protection. These protective measures can safeguard against credential-based attacks and provide behavioral analytics through platforms like Cortex XDR Pro. It's crucial for organizations to stay updated on these threats and implement robust cybersecurity strategies to mitigate potential damage.