The Lemon Duck malware Sophos recently discovered that the advanced crypto-miner malware, Lemon Duck, had added the ProxyLogon exploit to one of its updates. According to Sophos senior threat researcher, Rajesh Nataraj, this updated version was being used to target unpatched Microsoft Exchange servers alongside a range of features that, between them, allow the malware to establish a 'firm foothold' in a compromised server, while evading detection by defenders. Attacks using the ProxyLogon exploit involve the injection of web shells onto an infected server.