In the attack detailed by Varonis, the attacker focused in on ProxyShell Remote Code Execution (RCE) vulnerabilities that have been used in the past by other threat groups, including Conti. Microsoft patched the flaws – tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 – a year ago, but not all organizations updated their Exchange Servers. After exploiting the vulnerabilities, the attacker deployed a backdoor webshell that executed malicious PowerShell code in the compromised system with SYSTEM privileges and then followed with additional stagers from a command-and-control (C2) server linked to the Cobalt Strike framework. Part of the framework included an additional obfuscated PowerShell script. The hacker took control of the domain administrator account and moved laterally through the network, according to the researchers.