Threat actors affiliated with a ransomware strain known as Play are leveraging a never-before-seen exploit chain that bypasses blocking rules for ProxyNotShell flaws in Microsoft Exchange Server to achieve remote code execution (RCE) through Outlook Web Access (OWA).
"The new exploit method bypassesΒ URL rewrite mitigationsΒ for theΒ Autodiscover endpoint," CrowdStrike researchers Brian Pitchford,