How are hackers exploiting N-day vulnerabilities in Microsoft Exchange servers using GhostContainer malware?

Key takeaways

• GhostContainer was found on two high-value targets, a government agency and a tech company in Asia.
• The attackers used known, already patched Exchange flaws, so unpatched servers were the real weakness.
• Patch Exchange promptly, restrict who can reach it and monitor server behaviour for new modules.

Table of Contents

• What Is GhostContainer Malware?
• Why Is This Important?
• Real-World Example
• How GhostContainer Works (Simplified Explanation)
• A Closer Look: GhostContainer’s Architecture
• GhostContainer’s 14 Commands Explained
• How GhostContainer Communicates
• How to Detect GhostContainer Malware
• Why Are N-Day Vulnerabilities Still Dangerous?
• How to Protect Our Organization
• Conclusion

What Is GhostContainer Malware?

Imagine a malware so stealthy that it hides inside Microsoft Exchange servers, blending in with regular email traffic. That’s exactly what security researchers have found in a new Advanced Persistent Threat (APT) campaign targeting government agencies and tech companies in Asia. The malware is called GhostContainer, and it’s using known security gaps in Exchange servers to quietly take control.

Why Is This Important?

Microsoft Exchange powers email systems for businesses and governments worldwide. If attackers compromise Exchange servers, they can read emails, steal sensitive data, and even use those servers as hidden gateways into larger networks. GhostContainer isn’t using some new zero-day vulnerability, it’s weaponizing an older vulnerability, CVE-2020-0688, which many organizations still haven’t patched.

Real-World Example

In June 2026, Kaspersky analysts found GhostContainer malware on two high-value targets:

• A government agency in Asia handling national infrastructure.

• A large high-tech company managing sensitive intellectual property.

Both organizations were unaware of the intrusion until forensic teams noticed strange web requests and hidden files deep within their Exchange systems.

How GhostContainer Works (Simplified Explanation)

Step 1: Exploiting the Vulnerability
GhostContainer exploits CVE-2020-0688, an old vulnerability in Microsoft Exchange that allows remote attackers to execute commands using forged session tokens.

Step 2: Installing a Multi-Function Backdoor
Once in, the attackers drop a malicious file:

• Filename: App_Web_Container_1.dll

• MD5: 01d98380dfb9211251c75c87ddb3c79c

This backdoor does more than steal files. It’s a full command-and-control center, supporting 14 different operations.

Step 3: Hiding Inside Exchange Traffic
GhostContainer doesn’t rely on external command servers. It blends its communications with legitimate Exchange web traffic, making it extremely hard to detect using traditional security tools.

A Closer Look: GhostContainer’s Architecture

• Evasion Tactics: Overwrites AMSI (Antimalware Scan Interface) and Windows Event Log memory to avoid detection.

• Encryption: Uses the Exchange server’s ASP.NET validation key hashed with SHA-256 for AES-encrypted communications.

GhostContainer’s 14 Commands Explained

How GhostContainer Communicates

Instead of using visible external servers, GhostContainer:

• Uses Neo-reGeorg tunneling techniques.

• Employs custom HTTP headers like Qprtfva and Dzvvlnwkccf to hide control data.

• Creates long-lasting TCP tunnels embedded within Exchange web traffic.

How to Detect GhostContainer Malware

Indicators of Compromise (IoC):

• Filename: App_Web_Container_1.dll

• MD5 Hash: 01d98380dfb9211251c75c87ddb3c79c

• SHA256 Hash: 87a3aefb5cdf714882eb02051916371fbf04af2eb7a5ddeae4b6b441b2168e36

• Suspicious HTTP headers: Qprtfva, Dzvvlnwkccf

• Unusual Exchange web requests containing /wEPDwUKLTcyODc4

Suggested Detection Steps:

• Scan Exchange server directories for unknown DLL files.

• Check HTTP logs for suspicious header patterns.

• Monitor for repeated long-duration TCP connections from Exchange services.

• Review AMSI and Event Log behavior for tampering.

Why Are N-Day Vulnerabilities Still Dangerous?

N-day vulnerabilities are flaws that have been publicly disclosed and patched, but many organizations haven’t applied those patches. In this case:

• CVE-2020-0688 was disclosed 5 years ago.

• GhostContainer shows attackers can still exploit unpatched servers.

How to Protect Your Organization

1. Patch Exchange Servers Immediately: Ensure CVE-2020-0688 is fixed.

2. Audit Web Applications: Check for unauthorized DLL files in server directories.

3. Implement Network Segmentation: Limit Exchange server access to internal traffic only.

4. Deploy EDR Tools with Memory Scanning: Look for in-memory injection and tunneling behavior.

5. Monitor Custom HTTP Headers: Use security appliances to detect abnormal headers like Qprtfva.

6. Regular Threat Hunting: Actively search for APT indicators instead of relying on antivirus alone.

Conclusion

GhostContainer is a reminder that sophisticated attackers don’t always need new zero-days. By cleverly repurposing known exploits and hiding inside trusted systems like Microsoft Exchange, they can establish long-term footholds in sensitive environments.

If you operate Exchange servers, treat this as a critical wake-up call. Patch vulnerabilities, monitor unusual behaviors, and deploy layered security solutions, before your organization becomes the next GhostContainer victim.

To take this further with guided labs and an instructor, see our Security Operations Center programme.

Related reading

• What Are the Top Automated Malware Analysis Tools for Cybersecurity Professionals? The Detailed Guide
• Actively Exploited SharePoint 0-Day Vulnerabilities CVE-2025-53770 & CVE-2025-53771 | Metasploit RCE Module Released
• How are hackers using DNS blind spots to hide and deliver malware in 2026, and what can organizations do to detect and prevent these DNS-based cyber attacks?

Reference

For the authoritative details, see National Vulnerability Database.