GhostEmperor: From ProxyLogon to kernel modeWhile investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. With a long-standing operation, high profile victims, advanced toolset and no affinity to a known threat actor, we decided to dub the cluster GhostEmperor.
Source:
GhostEmperor: From ProxyLogon to kernel mode
