Microsoft has announced that two (2) reported critical zero-day vulnerabilities are being actively exploited in-the-wild. The flaws are part of an attack-chain of vulnerabilities, affecting Microsoft Exchange Servers 2013, 2016, and 2019. The first vulnerability, tracked as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) which allows an unauthenticated threat actor to bypass authorization, allowing them to remotely trigger the second vulnerability, which is tracked as CVE-2022-41082. This flaw is a remote code execution (RCE) vulnerability and allows the threat actors to execute arbitrary code in the target infrastructure. It should be noted that though this attack chain is quite severe, the threat actors would first have to gain initial access to the vulnerable Exchange Server. These vulnerabilities were first detected and reported to Microsoft by security researchers from the Vietnamese cybersecurity firm GTSC. The researchers determined that threat actors are exploiting the vulnerabilities to deploy “Chinese Chopper” web shells on the compromised servers. Chinese Chopper allows the threat actors to establish network persistence and exfiltrate sensitive data, as well as move latterly to infect other systems on the victims’ networks. Based on the tactics, techniques, and procedures (TTPs) of this attack, and the web shells’ code, GTSC has reasonable evidence to suspect that a Chinese threat actor is responsible. Although there are no official patches at this time, Microsoft has published manual mitigation techniques (initially provided by GTSC researchers when reporting the flaws) linked in the advisory below. CTIX analysts advise customers utilizing the affected servers to implement the mitigations and add the provided indicators of compromise for the Chinese Chopper web shell to their infrastructure. The CTIX team will continue to monitor this attack-chain and may provide an update to this piece if a Microsoft patch is made available.