CISA is warning about a surge of ProxyShell attacks, as Huntress discovered 140 webshells launched against 1,900 unpatched Microsoft Exchange servers. CISA jumped in to call for organizations to shore up defenses against the wave of attacks. The most common webshell attacks were XSL Transform (used 130 times), followed by Encrypted Reflected Assembly Loader, Comment Separation and Obfuscation of the unsafe Keyword, Jscript Base64 Encoding and Character Typecasting and Arbitrary File Uploader.”]
Source: https://threatpost.com/proxyshell-attacks-unpatched-exchange-servers/168879/