Proxyshell

ProxyShell is a series of vulnerabilities affecting Microsoft Exchange email servers. These flaws in software design or implementation have been exploited by threat actors to gain unauthorized access and control over targeted systems. The ProxyShell vulnerability, officially tracked as CVE-2021-34473, was actively exploited by attackers, causing cybersecurity agencies worldwide to issue urgent alerts for organizations to protect against this exploitation. Notably, the Australian Cyber Security Centre warned about ProxyShell targeting within Australia, emphasizing the global reach of this threat. The ProxyShell vulnerability was not the only one leveraged by cybercriminals; other known vulnerabilities such as ProxyLogon (CVE-2021-26855) were also exploited. According to a joint Cybersecurity Advisory (CSA), Iranian government-sponsored Advanced Persistent Threat (APT) actors had been scanning for and exploiting these vulnerabilities since early 2021. Other threat groups, like BlackByte, pivoted from their usual practice of exploiting public-facing vulnerabilities to using ProxyShell to gain an initial foothold. Additionally, the APT group ToddyCat was found repeatedly targeting these vulnerabilities, particularly those in Microsoft Exchange servers. In response to these threats, it has been recommended that organizations protect against the exploitation of these vulnerabilities using Anti-Exploitation modules and Behavioral Threat Protection. Cortex XSIAM, for instance, provides protection against the exploitation of different vulnerabilities including ProxyShell and ProxyLogon. However, the repeated use of these exploits emphasizes the importance of hardening and patching sensitive internet-facing assets. Microsoft, in particular, has faced criticism for perceived lax cybersecurity operations, leading to high-profile cyberattacks such as the compromise of the Microsoft 365 cloud environment and a series of PrintNightmare vulnerabilities.