ProxyShell Affecting Microsoft Exchange Servers

Threat actors are exploiting three chained vulnerabilities, CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207, collectively known as ProxyShell, to attack Microsoft Exchange Servers. The attack allows unauthenticated remote code execution. The attackers deploy web shells and use “createhidetask.exe” to create a scheduled task named “PowerManger”, which runs “ApplicationUpdate.exe” as a backdoor at 1 AM every day.