ProxyLogon: patch Exchange, then look for web shells
Four Exchange zero-days are being mass-exploited. Patching closes the door but doesn’t remove anyone already inside.
Last Tuesday Microsoft released emergency patches for four Exchange Server bugs, known as ProxyLogon. A state-backed group was using them first; now many groups are scanning the whole internet. Tens of thousands of servers have been hit.
The attack drops a web shell, a small file that gives the attacker remote control, and that stays after you patch.
If you run Exchange on your own servers:
- Patch now, or apply Microsoft’s interim mitigations if you truly can’t.
- Run Microsoft’s detection script and scanner to look for web shells and signs of exploitation.
- If you find anything, treat it as a breach: check for new accounts, stolen mail and spread to other servers.
- Limit who can reach Outlook on the web from the internet, for example through a VPN or reverse proxy with pre-authentication.
Exchange 2013, 2016 and 2019 are affected. Exchange Online isn’t.