# PRC-linked attackers exploit Exchange Server zero-days for code execution

Published: 2025-06-20 · Severity: high · Sectors: government-national, financial-services, healthcare, energy, telecommunications
Canonical: https://vorant.io/reports/ea74a235-d30f-5560-b302-a36b176bc610/prc-linked-attackers-exploit-exchange-server-zero-days-for-code-execution

> Four Exchange Server vulnerabilities enable unauthenticated RCE and persistent access; active exploitation and ransomware deployment observed.

CISA and Microsoft disclosed active exploitation of four critical vulnerabilities in on-premises Microsoft Exchange Server 2013, 2016, and 2019. CVE-2021-26855 allows unauthenticated attackers to bypass authentication via Server-Side Request Forgery in the Exchange Control Panel, granting mailbox access and credential theft. Three remote code execution vulnerabilities (CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) enable post-authentication arbitrary file writes and deserialization attacks, leading to SYSTEM-level code execution. Successful exploitation grants persistent access, enables mailbox and credential exfiltration, compromises Active Directory, and facilitates malware deployment including the DearCry ransomware. The activity is attributed to Chinese state-sponsored actors affiliated with the Ministry of State Security. Exploitation is occurring in the wild with attackers deploying webshells (China Chopper variants and others) for persistence and lateral movement. Defenders must prioritize patching immediately or implement network-level mitigations to restrict external access to OWA and ECP endpoints.

## Mentioned in this report

- Vulnerabilities: CVE-2021-26855 (KEV), CVE-2021-26857 (KEV), CVE-2021-26858 (KEV), CVE-2021-27065 (KEV)
- Threat actors: Chinese Ministry of State Security, HAFNIUM
- Malware: China Chopper, dearcry
- Campaigns: Hafnium Exchange Server exploitation campaign

## Detection guidance (public sample)

### Exchange Unified Messaging or IIS Worker Spawning Command Shell

ATT&CK: T1190

Detects the Exchange UM service, UM worker process or IIS worker (w3wp) running the Exchange back end spawning cmd.exe or PowerShell, a pattern seen in ProxyLogon exploitation and webshell use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exchange Unified Messaging or IIS Worker Spawning Command Shell
id: 46dbe7d8-6fbd-5fbe-bbe1-f36be28c9414
status: experimental
description: Detects Exchange UMWorkerProcess, UMService or w3wp.exe hosting Exchange
  application pools spawning cmd.exe, PowerShell or other script interpreters. Seen
  in ProxyLogon (CVE-2021-26857/26858/27065) exploitation and China Chopper webshell
  command execution.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.004
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_um:
    ParentImage|endswith:
    - \UMWorkerProcess.exe
    - \UMService.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \bitsadmin.exe
  selection_w3wp:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains:
    - MSExchange
    - ExchangeServicesAppPool
    - ExchangeCompliance
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \net.exe
    - \whoami.exe
  condition: 1 of selection_*
falsepositives:
- Exchange management scripts or health probes launched under the Exchange app pool
  that invoke cmd.exe
- Third-party Exchange monitoring or backup agents spawning shells from the worker
  process
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a
```

### Webshell Dropped in Exchange or IIS Web Directories

ATT&CK: T1505.004

Detects creation of script or web-content files (aspx, asmx, ashx) in Exchange OWA/ECP auth directories or inetpub wwwroot by processes other than normal installers, as with China Chopper deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Webshell Dropped in Exchange or IIS Web Directories
id: f746199b-b6c6-552c-a34e-85fd5cfb8934
status: experimental
description: Detects aspx/asmx/ashx/asp files written into Exchange FrontEnd HttpProxy
  owa/ecp directories, the OWA auth folder or inetpub wwwroot aspnet_client by w3wp,
  UM or interpreter processes. Typical ProxyLogon arbitrary file write used to plant
  China Chopper style webshells.
tags:
- attack.persistence
- attack.t1505.004
- attack.initial-access
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
    - \FrontEnd\HttpProxy\owa\auth\
    - \FrontEnd\HttpProxy\ecp\
    - \inetpub\wwwroot\aspnet_client\
    - \ClientAccess\owa\auth\
    TargetFilename|endswith:
    - .aspx
    - .asmx
    - .ashx
    - .asp
  selection_proc:
    Image|endswith:
    - \w3wp.exe
    - \UMWorkerProcess.exe
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter_installer:
    Image|endswith:
    - \msiexec.exe
    - \setup.exe
    - \TrustedInstaller.exe
  condition: selection_path and selection_proc and not filter_installer
falsepositives:
- Exchange cumulative update or security patch installation writing files into the
  front end directories
- Administrators deploying custom OWA pages
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a
```

### Exchange Server Process Dumping LSASS or Downloading Tools via PowerShell

ATT&CK: T1003

Detects Exchange worker or IIS parent processes launching PowerShell/cmd that dumps LSASS memory or downloads payloads, matching post-exploitation credential theft and ingress tool transfer. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exchange Server Process Dumping LSASS or Downloading Tools via PowerShell
id: 16060c06-0819-517b-b964-54e26b31dbde
status: experimental
description: Detects post-exploitation commands launched from w3wp.exe, UMWorkerProcess.exe
  or their child shells on Exchange servers, such as comsvcs.dll MiniDump of lsass,
  procdump against lsass, or PowerShell download cradles. Based on ProxyLogon actors
  dumping credentials and pulling tools.
tags:
- attack.credential-access
- attack.t1003
- attack.execution
- attack.t1059.001
- attack.command-and-control
- attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \w3wp.exe
    - \UMWorkerProcess.exe
    - \UMService.exe
  selection_dump:
    CommandLine|contains:
    - comsvcs.dll
    - procdump
    - lsass
    - ntdsutil
    - sekurlsa
  selection_download:
    CommandLine|contains:
    - DownloadString
    - DownloadFile
    - Invoke-WebRequest
    - Net.WebClient
    - Start-BitsTransfer
    - bitsadmin
    - urlcache
  condition: selection_parent and (selection_dump or selection_download)
falsepositives:
- Exchange administrative scripts running from the app pool that legitimately download
  updates
- Security tooling running diagnostics under the IIS worker context
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ea74a235-d30f-5560-b302-a36b176bc610/prc-linked-attackers-exploit-exchange-server-zero-days-for-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup