Microsoft is currently investigating allegations that a previously unknown Exchange Server zero-day vulnerability was exploited by Lockbit-affiliated threat actors in summer 2022 to conduct a ransomware attack. Researchers from the South Korean cybersecurity firm AhnLab were hired by Microsoft to assist with the investigation, following their discovery of the flaw on July 21, 2022. AhnLab researchers allegedly identified the vulnerability after one (1) of their vendors fell victim to a ransomware attack, leading to the exfiltration of approximately 1.3 TB of data. AhnLab analyzed the two (2) compromised servers running Windows Server 2016 Standard and found WebShell files installed just seven (7) days before the vendor had their data encrypted, likely being possible through the exploitation of an unknown vulnerability. Following the download of the WebShell files, the threat actors enabled an RDP connection via SSH tunneling, and then utilized the open source “BloodHound” tool to move laterally across the network and provide visibility into the vendor’s Active Directory (AD) environment. The threat actors identified the AD admin account and extracted the credentials using Mimikatz. The investigation showed evidence that multiple IPs associated with VPNs were used for the WebShell calls, and all remote commands to control the ransomware were executed using Wmic. Some researchers have noted that it could be possible that the threat actors exploited the “ProxyNotShell” vulnerability (CVE-2022-41040 and CVE-2022-41082) to facilitate the attack, however most researchers disagree based on the tactics, techniques, and procedures (TTPs) utilized during the attack. AhnLab stated the attack method, the generated WebShell filename, and follow-on activity after the WebShell installation suggest that another attacker exploited a different zero-day vulnerability. To add more evidence to the argument that the flaw is a zero-day, the extorted vendor had already fallen victim to an Exchange Server vulnerability exploitation in 2021, and thereby received ongoing technical support from Microsoft via quarterly security patches. If the July 9 Microsoft patch was unable to defend against an attack on the 21st, it is highly likely that this most recent Exchange compromise is the result of an exploited zero-day vulnerability. There is very little technical information about this flaw, and CTIX analysts will monitor the matter and provide an update in a future FLASH issue.