According to Kaspersky telemetry, in the last week of the summer, over 1,700 users were attacked using ProxyShell exploits daily, leading to the number of users attacked in August 2021 to grow by 170% compared to July 2021. This reflects the large scale problem these vulnerabilities represent, if left unpatched.
“The fact that these vulnerabilities are being actively exploited comes as no surprise – quite often, 1-day vulnerabilities – the ones that have already been disclosed and have patches released by developers – represent an even bigger threat as they are known to a wider array of cybercriminals who try their luck in penetrating any network they can get their hands on. This active growth of attacks demonstrates once again why it is so essential to patch vulnerabilities as soon as possible to prevent the networks from being compromised. We strongly recommend following Microsoft’s recent advisory to mitigate any wider risks,” comments Evgeny Lopatin, security researcher, Kaspersky.
Kaspersky products protect against exploits that abuse ProxyShell vulnerabilities with Behavior Detection and Exploit Prevention components and detect exploitation with the following verdicts:
- PDM:Exploit.Win32.Generic
- HEUR:Exploit.Win32.ProxyShell.*
- HEUR:Exploit.*.CVE-2021-26855.*
To protect against attacks exploiting the aforementioned vulnerability, Kaspersky recommends the following:
- Update Exchange Server as soon as possible
- Focus defense strategy on detecting lateral movements and data exfiltration to the internet. Pay special attention to outgoing traffic to detect cybercriminal connections. Back up data regularly. Make sure you can quickly access it in an emergency
- Use solutions like Kaspersky Endpoint Detection and Response and the Kaspersky Managed Detection and Response service, which help to identify and stop an attack in the early stages, before the attackers achieve their goals
- Use a reliable endpoint security solution such as Kaspersky Endpoint Security for Business that is powered by exploit prevention, behavior detection and a remediation engine that can roll back malicious actions. KESB also has self-defense mechanisms that can prevent its removal by cybercriminals
