--- title: ProxyShell Exchange Exploitation Now Leads To An Increasing Amount Of Cobaltstrike Backdoors description: Threat actors had been caught targeting MS Exchange servers via ProxyShell vulnerabilities. Fortunately, Morphisec Guard prevents Cobaltstrike backdoors. image: https://blog.morphisec.com/hubfs/Morphisec%20Prevents%20and%20Detects%20Cobaltstrike-1.png --- Recent Webinar: Building an Adaptive Cyber Resilient Cloud ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa) ![close](https://www.morphisec.com/hubfs/close.svg) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) - ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) - [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) Cybersecurity Blog Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security # ProxyShell Exchange Exploitation Now Leads To An Increasing Amount Of Cobaltstrike Backdoors Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on August 27, 2021 - [Tweet](https://twitter.com/share) ![Morphisec Prevents and Detects Cobaltstrike Backdoors](https://blog.morphisec.com/hubfs/Morphisec%20Prevents%20and%20Detects%20Cobaltstrike.png)On approximately August 21, 2021, security researchers, cybersecurity leaders, and eventually the CISA began voicing concerns about the inevitable threat of LockFile ransomware attacks on a wide variety of ill-informed and unprepared victims. Threat actors had been caught targeting on-premise Microsoft Exchange servers via [ProxyShell vulnerabilities.](https://us-cert.cisa.gov/ncas/current-activity/2021/08/21/urgent-protect-against-active-exploitation-proxyshell) These vulnerabilities have been dubbed [“worse than ProxyLogon.](https://doublepulsar.com/multiple-threat-actors-including-a-ransomware-gang-exploiting-exchange-proxyshell-vulnerabilities-c457b1655e9c)” Patches for these vulnerabilities were made available in April and May, but many servers were still vulnerable.  That same day, Morphisec's zero-trust, endpoint protection platform [Morphisec Guard](https://www.morphisec.com/products/morphisec-guard-endpoint-protection) successfully detected and prevented the execution of Cobalt Strike beacons delivered via a ProxyShell exploit. Morphisec actively protected the exchange servers of our customers. Below is an example of one of the prevention events: ![ProxyShell](https://blog.morphisec.com/hubfs/ProxyShell.png) Cmd execution: **![cmd](https://blog.morphisec.com/hubfs/cmd.png)** **Cobalt C2:** **hxxp://at.miyazono[.]tk** ## Conclusion  Morphisec demonstrates the vital nature of a strong prevention strategy for servers. We strongly encourage enterprises to augment detection-centered strategies and tools with more preventative, proactive solutions. [![LEARN MORE](https://no-cache.hubspot.com/cta/default/1534169/14d71866-98c0-4511-bb08-ad1c2a6ebbe8.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/14d71866-98c0-4511-bb08-ad1c2a6ebbe8)   ### Subscribe to our blog Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates. [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4) ### Search Our Site ### Recent Posts ### Posts by Tag - [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense) - [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research) - [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news) - [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs) - [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news) - [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management) - [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth) - [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware) - [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security) - [Gartner (10)](https://1534169.hs-sites.com/topic/gartner) - [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem) - [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft) - [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks) - [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity) - [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense) - [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity) - [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security) - [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence) - [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity) - [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware) - [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management) - [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers) [See all](https://1534169.hs-sites.com/proxyshell-exchange-exploitation-now-leads-to-an-increasing-amount-of-cobaltstrike-backdoors#) - [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec) - [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec) - [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw) © 2026 Morphisec Ltd. | All rights reserved ![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Morphisec Labs", "url" : "https://1534169.hs-sites.com/author/morphisec-labs" }, "dateModified" : "2024-11-07T19:23:52.358Z", "datePublished" : "2021-08-27T16:44:00.000Z", "headline" : "ProxyShell Exchange Exploitation Now Leads To An Increasing Amount Of Cobaltstrike Backdoors", "image" : [ "https://blog.morphisec.com/hubfs/Morphisec%20Prevents%20and%20Detects%20Cobaltstrike-1.png" ], "mainEntityOfPage" : { "@id" : "https://1534169.hs-sites.com/proxyshell-exchange-exploitation-now-leads-to-an-increasing-amount-of-cobaltstrike-backdoors", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png" }, "name" : "Morphisec" } } ```