AvosLocker, a ransomware-as-a-service threat affiliate, has been observed shifting to Microsoft Exchange server vulnerabilities as their point-of-compromise tactic in their recent cyberattacks against organizations domestically. Historically, AvosLocker targets organizations within the financial services industry, critical manufacturing operations, and state/national government facilities. Microsoft Exchange servers have a high number of critical vulnerabilities that have been discovered over the last year, including commonly exploited flaws in CVE-2021-31207, CVE-2021-34523, CVE-2021-34473, and CVE-2021-26855; otherwise commonly referred to as the ProxyShell attack chain. In addition to these vulnerabilities is CVE-2021-26855, which relates to the ProxyLogon vulnerability, which allows threat actors to drop malicious web shells onto Exchange servers to do any number of malicious activities. AvosLocker continues to be one of the key ransomware affiliates targeting critical infrastructure and are expected to continue their operations throughout the coming months. Additionally, CTIX urges organizations throughout the globe to verify that their technological infrastructure is up-to-date and security defenses are in place to protect company employees and assets.