CVE-2022-41040 is a server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server, known as "ProxyNotShell." It can be chained with CVE-2022-41082 to achieve remote code execution. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
The Play ransomware group has been active since June 2022, targeting businesses and critical infrastructure in North America, South America, and Europe. They gain access by exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. Their attacks follow a double extortion model, encrypting systems after exfiltrating data using AES-RSA hybrid encryption. The group employs various tools for network discovery, credential theft, and lateral movement. Organizations are advised to implement multifactor authentication, regular patching, network segmentation, and maintain offline backups to reduce risk.
