Microsoft Exchange Servers being Compromised by IIS Backdoors

Threat actors are using malicious Internet Information Services (IIS) web server extensions to backdoor unpatched Microsoft Exchange servers. These modules provide persistent access, harvest credentials, collect information, and deliver additional payloads. A campaign exploiting ProxyShell deployed “FinanceSvcModel.dll” to access mailboxes, execute commands, and steal data. The advisory also describes Gelsemium activity using the SessionManager IIS backdoor after exploiting ProxyLogon, and attacks using the Owowa malicious IIS module.