Compromised Microsoft Exchange Server Used to Host Cryptominer

Researchers say an unknown attacker is targeting vulnerable Exchange Servers with a payload hosted on a compromised Exchange Server.

Dark Reading Staff, Dark Reading

April 14, 2021

1 Min Read
Dark Reading logo in a gray background | Dark Reading

Researchers at Sophos report an unknown attacker is attempting to use a compromised Microsoft Exchange Server to deliver a malicious Monero cryptominer onto other vulnerable Microsoft Exchange Servers. Monero is an anonymous form of cryptocurrency that is favored by attackers over the more popular Bitcoin.

The attack uses the ProxyLogon exploit. Because the cryptominer is hosted on a compromised Exchange Server, it may be easier for the attacker to deliver the payload to other vulnerable targets as firewalls are less likely block traffic between Exchange Servers.

The SophosLabs team has been examining telemetry in the weeks following Microsoft's news about the serious Exchange Server vulnerability and came across the attack targeting a customer's Exchange Server.

"The attack begins with a PowerShell command to retrieve a file named win_r.zip from another compromised server's Outlook Web Access logon path (/owa/auth)," Sophos says in a release on the details of the exploit.

A breakdown of how the attack works can be found here.

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights