Cyberint National Center specialists recently sent a notification about a ransomware campaign (called " Black Kingdom ") used to exploit MS Exchange's ProxyLogon vulnerabilities for encryption of servers. How does the attack work and what can you do to protect yourself? The attacker uses these vulnerabilities to run a PowerShell script that downloads the ransomware executable from the " yuuuuu44 [.] Com " domain , then distributes it to other stations on the network. As an operating mode, the ransomware product encrypts files on the infected station using random extensions and creates a ransom text file (called decrypt_file.TxT or ReadMe.txt ) . To prevent infection with this ransomware, we recommend that you urgently apply the latest updates available to vulnerable servers, if you haven't already! Also, as additional protection measures, it is recommended: use of an antivirus solution for servers performing a regular backup (daily, weekly) for critical da...