{"uuid": "75477fe9-f792-4e86-abf3-e93c81b9e42c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/33374", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange servers hacked to deploy BlackByte ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views: 118 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe BlackByte ransomware gang is now breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.\nProxyShell is the name for a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.\n\nThese vulnerabilities are listed below and were fixed by security updates released in April and May 2021:\n\n* CVE-2021-34473\u00a0\u2013 Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)\n* CVE-2021-34523\u00a0\u2013 Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)\n* CVE-2021-31207\u00a0\u2013 Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)\n\nSince researchers disclosed the vulnerabilities, threat actors have begun to exploit them\u00a0to breach servers and install web shells, coin miners, and ransomware.\nSee Also: Complete Offensive Security and Ethical Hacking Course BlackByte\u00a0begins exploiting ProxyShellIn a detailed report by Red Canary, researchers analyzed a BlackByte\u00a0ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.\n\nWeb Shells are small scripts uploaded to web servers that allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.\nhttps://www.bleepstatic.com/images/news/security/webshell-example.jpg \nBlackByte is still a severe threatWhen conducting ransomware attacks, threat actors commonly use third-party tools to gain elevated privileges or deploy the ransomware on a network.\n\nHowever, the actual BlackByte ransomware executable plays a central role as it handles both privilege escalation and the ability to worm, or perform lateral movement, within the compromised environment.\n\nThe malware sets three registry values, one for local privilege elevation, one for enabling network connection sharing between all privilege levels, and one to allow long path values for file paths, names, and namespaces.\n\nBefore encryption, the malware deletes the \u201cRaccine Rules Updater\u201d scheduled task to prevent last-minute interceptions and also wipes shadow copies directly through WMI objects using an obfuscated PowerShell command.\n\nFinally, stolen files are exfiltrated using WinRAR to archive files and anonymous file-sharing platforms such as \u201cfile.io\u201d or \u201canonymfiles.com.\u201d\n\nAlthough Trustwave released a decryptor\u00a0for BlackByte ransomware in October 2021, it is unlikely that the operators are still using the same encryption tactics that allowed victims to restore their files for free.\n\nAs such, you may or may not be able to restore your files using that decryptor, depending on what key wa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:07.491397Z"}