No, I Did Not Hack Your MS Exchange Server
Summary: The Shadowserver Foundation found 21,248 Microsoft Exchange Server systems compromised by a backdoor that communicates with the domain brian[.]krebsonsecurity[.]top, following waves of attacks on Exchange flaws Microsoft patched in an emergency release earlier in March 2021. On Mar. 26, Shadowserver saw a new backdoor installed at the path /owa/auth/babydraco.aspx, which ran a PowerShell script fetching a file named krebsonsecurity.exe from 159.65.136[.]128 that installs a root certificate, modifies the registry, and tells Windows Defender not to scan it.
What's compelling: More than 21,000 Exchange servers carried the Babydraco backdoor, and Shadowserver was tracking 73,927 unique active webshell paths across 13,803 IP addresses on Mar. 25, while Microsoft estimated about 400,000 Exchange systems were vulnerable and tens of thousands remained exposed online.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026