Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk
Summary: Cisco Talos discovered a campaign on Oct. 12, 2021 that exploited the ProxyShell vulnerability in Microsoft Exchange servers to deploy Babuk ransomware, using a downloader run by the Exchange IIS worker process w3wp.exe. The chain pulled an intermediate unpacker from the pastebin.pl clone, decrypted the payload in memory, injected it into AddInProcess32, deleted volume shadow copies with vssadmin, stopped backup services such as Veeam, and appended .babyk to encrypted files while demanding $10,000 USD.
Key Takeaway: The actor deleted VSS snapshots and terminated backup services before encrypting, and the recently released Babuk decryptor does not work on this variant, so recovery depends on backups the ransomware did not reach. Talos attributes the campaign's spread to the July leak of the Babuk builder and source code, which put it in reach of operators like Tortilla who had been active only since early July.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026