Cryptolaemus on Twitter: "We have been seeing the TR Distro actor (we call them ChaserLdr) utilize compromised Exchange servers vulnerable to Proxylogon/ProxyShell to send malspam for about 1 week with artifacts indicating access going back to earlyOCT. 1/x" / Twitter
https://twitter.com/cryptolaemus1/status/1455264060644204550