An unpatched on-premises Exchange server was compromised and the attacker reached Active Directory: contained, rebuilt as a redundant DAG and re-tiered

A professional services company ran its own Microsoft Exchange server and Active Directory, and called our team when staff found odd mailbox rules and a backup account signing in at night. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. The Exchange server was several updates behind and published to the internet, which made it exposed to ProxyShell, a chain of three vulnerabilities (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207) that Microsoft patched in 2021 and that CISA warned was being exploited.

Containment came first. The server was taken off the internet path, suspect accounts were disabled, and disk, memory and web server logs were preserved before any cleanup, so the evidence survived. Log analysis then showed requests that match public ProxyShell write-ups, a web shell in a web-served directory, and mailbox export requests that told us which mail could have been taken. A server that has run attacker code is rebuilt, not cleaned.

The attacker's next step was Active Directory. Accounts with a Service Principal Name can be Kerberoasted: any domain user can request a service ticket and crack it offline, so a weak service password falls without ever touching the account. One such account was in Domain Admins. We replaced it with group managed service accounts, which use long random passwords that Windows rotates, rotated every privileged credential, and reset the krbtgt account twice, with a wait for replication between resets, to invalidate any forged tickets.

Recovery used a clean build. New Exchange servers on a supported version went into two sites as a database availability group (DAG), with a copy of every database and a file share witness in a third location, so one server or one site can fail without mail stopping. Mail flowed through a temporary path while this was built, and mailbox data moved only after it was checked.

The directory was then re-tiered. Domain controllers, servers and workstations each have their own administrator accounts, privileged users cannot sign in to lower tiers, local administrator passwords are unique per machine, and security updates have a fast path and a staging server. This describes the outcome, not a guarantee against future attacks, and incident work like this runs only under written authorization from the system owner.