Security Experts:

Connect with us

Hi, what are you looking for?


Application Security

Babuk Ransomware Seen Exploiting ProxyShell Vulnerabilities

A newly observed Babuk ransomware campaign is targeting ProxyShell vulnerabilities in Microsoft Exchange Server, according to security researchers at Cisco Talos.

A newly observed Babuk ransomware campaign is targeting ProxyShell vulnerabilities in Microsoft Exchange Server, according to security researchers at Cisco Talos.

The researchers spotted signs that the attackers are leveraging a China Chopper web shell for the initial compromise, and then use that for the deployment of Babuk.

Tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, the issues were addressed in April and May, with technical details made public in August. An unauthenticated attacker can chain the bugs to for arbitrary code execution.

Attacks exploiting the security errors have been ongoing for the past several months, and Cisco’s researchers say that the Tortilla threat actor, which has been active since July 2021, has started targeting the Exchange Server flaws.

The employed infection chainfeatures an intermediate unpacking module that is downloaded from (a clone) and then decoded in memory before the final payload is decrypted and executed.

[ READ: Microsoft Exchange Servers in Attacker Crosshairs ]

Cisco Talos found a modified EfsPotato exploit that targets both ProxyShell and PetitPotam vulnerabilities is employed for initial intrusion.

Once executed, the Babuk ransomware attempts to disable a series of processes on the victim server, to stop backup products, and also deletes volume shadow service (VSS) snapshots. Next, it encrypts all files on the server and appends the file extension .babyk to them.

The ransomware then deploys a ransom note demanding a $10,000 ransom payment from the victim in exchange for a decryption key.

Initially detailed in January 2021, Babuk has been targeting both Windows and Linux systems within enterprise environments, and uses a rather complex key generation mechanism to prevent file recovery. A free decryption tool for Babuk was released last week.

“Organizations should regularly update their servers and applications with the latest available patches from the vendors eliminating the vulnerabilities in their environment. Defenders should be constantly looking for suspicious events generated by detection systems for an abrupt service termination, abnormally high I/O rates for drives attached to their servers, the deletion of shadow copies or system configuration changes,” Cisco Talos said.

Related: Free Decryption Tools Available for Babuk, AtomSilo and LockFile Ransomware

Related: Microsoft Issues Guidance on ProxyShell Vulnerabilities

Related: Microsoft Exchange Servers in Attacker Crosshairs

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...