Cisco Talos reports new variant of Babuk ransomware targeting Exchange servers

Cisco Talos has a warning out for U.S. companies about a new variant of the Babuk ransomware. The security researchers discovered the campaign in mid-October and think that the variant has been active since July 2021. The new element in this attack is an unusual infection chain technique.

Security researchers Chetan Raghuprasad, Vanja Svajcer and Caitlin Huey describe the new threat in a Talos Intelligence blog post. The researchers think that the initial infection vector is an exploitation of ProxyShell vulnerabilities in Microsoft Exchange Server through the deployment of China Chopper web shell.

Babuk can affect several hardware and software platforms but this version is targeting Windows. The ransomware encrypts the target's machine, interrupts the system backup process and deletes the volume shadow copies.  According to the researchers, the infection chain works like this: A DLL or .NET executable starts the attack on the victim's system. The DLL is a mixed mode assembly. The .NET executable version of the initial downloader is a modified variant of the EfsPotato exploit with code to download and trigger the next stage