Unpatched Microsoft Exchange Servers are Under Attack, the U.S. Cybersecurity and Infrastructure Security Agency is warning . There have been active exploitation attempts that leverage the latest line of “ProxyShell” Microsoft Exchange vulnerabilities. These Vulnerabilites that were patched earlier this May, including deploying LockFile ransomware on compromised systems.

More About the attacks

Tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. The vulnerabilities enable adversaries to bypass ACL controls, elevate privileges on the Exchange PowerShell backend. In doing so effectively permitting the attacker to perform unauthenticated, remote code execution.

While the former two were addressed by Microsoft on April 13. A patch for CVE-2021-31207 was shipped as part of the Windows maker’s May Patch Tuesday updates.

“An attacker exploiting these vulnerabilities could execute arbitrary code on a vulnerable machine,” CISA said.

Opportunistic Scanning & Exploitation

The development comes a little over a week after cybersecurity researchers sounded the alarm on opportunistic scanning and exploitation of unpatched Exchange servers by taking advantage of the ProxyShell attack chain.

This was originally demonstrated at the Pwn2Own hacking contest in April this year. ProxyShell is part of a broader trio of exploit chains discovered by DEVCORE security researcher Orange Tsai. That includes ProxyLogon and ProxyOracle, the latter of which concerns two remote code execution flaws. These flaws could be employed to recover a user’s password in plaintext format.

“They’re backdooring boxes with webshells that drop other webshells and also executables that periodically call out,” researcher Kevin Beaumont noted last week confirming case of Microsoft Exchange under Attack.

According to researchers from Huntress Labs, at least five distinct styles of web shells have been observed as deployed to vulnerable Microsoft Exchange servers. There have been over 100 incidents reported related to the exploit between August 17 and 18.

Web shells grant the attackers remote access to the compromised servers, but it isn’t clear exactly what the goals are or the extent to which all the flaws were used.

More than 140 web shells have been detected across no fewer than 1,900 unpatched Exchanger servers to date. Huntress Labs CEO Kyle Hanslovan tweeted, adding “impacted [organizations] thus far include building manufacturing, seafood processors, industrial machinery, auto repair shops, a small residential airport and more.”

Read Also: Hackers steal $600 Million in Cryptocurrency Heist