How are hackers exploiting N-day vulnerabilities in Microsoft Exchange servers using GhostContainer malware?

Table of Contents

• What Is GhostContainer Malware?
• Why Is This Important?
• Real-World Example
• How GhostContainer Works (Simplified Explanation)
• Deep Dive: GhostContainer’s Architecture
• GhostContainer’s 14 Commands Explained
• How GhostContainer Communicates
• How to Detect GhostContainer Malware
• Why Are N-Day Vulnerabilities Still Dangerous?
• How to Protect Our Organization
• Conclusion
• Frequently Asked Questions (FAQs)

What Is GhostContainer Malware?

Imagine a malware so stealthy that it hides inside Microsoft Exchange servers, blending in with regular email traffic. That’s exactly what security researchers have found in a new Advanced Persistent Threat (APT) campaign targeting government agencies and tech companies in Asia. The malware is called GhostContainer, and it’s using known security gaps in Exchange servers to quietly take control.

Why Is This Important?

Microsoft Exchange powers email systems for businesses and governments worldwide. If attackers compromise Exchange servers, they can read emails, steal sensitive data, and even use those servers as hidden gateways into larger networks. GhostContainer isn’t using some new zero-day vulnerability—it’s weaponizing an older vulnerability, CVE-2020-0688, which many organizations still haven’t patched.

Real-World Example

In June 2025, Kaspersky analysts found GhostContainer malware on two high-value targets:

• A government agency in Asia handling national infrastructure.

• A large high-tech company managing sensitive intellectual property.

Both organizations were unaware of the intrusion until forensic teams noticed strange web requests and hidden files deep within their Exchange systems.

How GhostContainer Works (Simplified Explanation)

Step 1: Exploiting the Vulnerability
GhostContainer leverages CVE-2020-0688, an old vulnerability in Microsoft Exchange that allows remote attackers to execute commands using forged session tokens.

Step 2: Installing a Multi-Function Backdoor
Once in, the attackers drop a malicious file:

• Filename: App_Web_Container_1.dll

• MD5: 01d98380dfb9211251c75c87ddb3c79c

This backdoor isn’t just about stealing files. It’s a full command-and-control center, supporting 14 different operations.

Step 3: Hiding Inside Exchange Traffic
GhostContainer doesn’t rely on external command servers. It blends its communications with legitimate Exchange web traffic, making it extremely hard to detect using traditional security tools.

Deep Dive: GhostContainer’s Architecture

• Evasion Tactics: Overwrites AMSI (Antimalware Scan Interface) and Windows Event Log memory to avoid detection.

• Encryption: Uses the Exchange server’s ASP.NET validation key hashed with SHA-256 for AES-encrypted communications.

GhostContainer’s 14 Commands Explained

How GhostContainer Communicates

Instead of using visible external servers, GhostContainer:

• Uses Neo-reGeorg tunneling techniques.

• Employs custom HTTP headers like Qprtfva and Dzvvlnwkccf to hide control data.

• Creates long-lasting TCP tunnels embedded within Exchange web traffic.

How to Detect GhostContainer Malware

Indicators of Compromise (IoC):

• Filename: App_Web_Container_1.dll

• MD5 Hash: 01d98380dfb9211251c75c87ddb3c79c

• SHA256 Hash: 87a3aefb5cdf714882eb02051916371fbf04af2eb7a5ddeae4b6b441b2168e36

• Suspicious HTTP headers: Qprtfva, Dzvvlnwkccf

• Unusual Exchange web requests containing /wEPDwUKLTcyODc4

Suggested Detection Steps:

• Scan Exchange server directories for unknown DLL files.

• Check HTTP logs for suspicious header patterns.

• Monitor for repeated long-duration TCP connections from Exchange services.

• Review AMSI and Event Log behavior for tampering.

Why Are N-Day Vulnerabilities Still Dangerous?

N-day vulnerabilities are flaws that have been publicly disclosed and patched—but many organizations haven’t applied those patches. In this case:

• CVE-2020-0688 was disclosed 5 years ago.

• GhostContainer shows attackers can still exploit unpatched servers.

How to Protect Your Organization

1. Patch Exchange Servers Immediately: Ensure CVE-2020-0688 is fixed.

2. Audit Web Applications: Check for unauthorized DLL files in server directories.

3. Implement Network Segmentation: Limit Exchange server access to internal traffic only.

4. Deploy EDR Tools with Memory Scanning: Look for in-memory injection and tunneling behavior.

5. Monitor Custom HTTP Headers: Use security appliances to detect abnormal headers like Qprtfva.

6. Regular Threat Hunting: Actively search for APT indicators, not just rely on antivirus.

Conclusion

GhostContainer is a reminder that sophisticated attackers don’t always need new zero-days. By cleverly repurposing known exploits and hiding inside trusted systems like Microsoft Exchange, they can establish long-term footholds in sensitive environments.

If you operate Exchange servers, treat this as a critical wake-up call. Patch vulnerabilities, monitor unusual behaviors, and deploy layered security solutions—before your organization becomes the next GhostContainer victim.

FAQs

What is GhostContainer malware?

GhostContainer is an advanced backdoor malware that specifically targets Microsoft Exchange servers by exploiting known N-day vulnerabilities like CVE-2020-0688.

How does GhostContainer malware infect Exchange servers?

It exploits the CVE-2020-0688 vulnerability to install malicious DLL files that act as backdoors, allowing attackers persistent access and control over the server.

What is CVE-2020-0688?

CVE-2020-0688 is a deserialization vulnerability in Microsoft Exchange servers that allows remote attackers to execute arbitrary code using forged session tokens.

How does GhostContainer evade detection?

GhostContainer bypasses security tools by hiding within legitimate Exchange web traffic, disabling AMSI and event logs, and using AES-encrypted communication.

What are the key components of GhostContainer malware?

It uses three main classes: Stub, App_Web_843e75cf5b63, and App_Web_8c9b251fb5b3, each serving functions like web proxy, tunneling, and virtual page injection.

What types of organizations are targeted by GhostContainer?

Government agencies and high-tech companies across Asia are the primary targets, focusing on critical national infrastructure.

What is an N-day vulnerability?

An N-day vulnerability is a known security flaw that has already been publicly disclosed and patched but remains exploitable due to unpatched systems.

How does GhostContainer communicate with attackers?

It uses Neo-reGeorg tunneling and custom HTTP headers like Qprtfva and Dzvvlnwkccf to hide control data within regular web traffic.

What kind of commands can GhostContainer execute?

It supports commands such as shellcode execution, file manipulation, running .NET programs, virtual page injection, and proxy tunneling.

What is the significance of App_Web_Container_1.dll?

It is the main malicious DLL file used by GhostContainer to install the backdoor within Microsoft Exchange servers.

How can organizations detect GhostContainer malware?

By scanning for IoCs such as suspicious DLL files, specific HTTP headers, and reviewing Exchange logs for abnormal activity patterns.

What are the Indicators of Compromise (IoC) for GhostContainer?

Key IoCs include the filename App_Web_Container_1.dll, MD5 hash 01d98380dfb9211251c75c87ddb3c79c, and specific HTTP header patterns.

How does GhostContainer achieve persistence?

It uses virtual page injection mechanisms and integrates with Exchange web services, allowing it to remain hidden even after server reboots.

What is virtual page injection in malware?

It’s a technique where malware creates hidden web pages within a server’s memory, bypassing traditional file system monitoring.

How is GhostContainer different from other Exchange malware?

It combines web proxy, tunneling, and stealth communication within a single backdoor, making it more versatile and harder to detect.

What is Neo-reGeorg tunneling?

It’s a tool used by GhostContainer to create long-lived TCP tunnels through web requests, disguising malicious traffic as legitimate Exchange communication.

Why is patching Exchange servers critical?

Unpatched servers remain vulnerable to known exploits like CVE-2020-0688, making them easy targets for malware like GhostContainer.

How long has GhostContainer been active?

Reports suggest GhostContainer has been active as of mid-2025, with evidence pointing to earlier undiscovered attacks.

Is GhostContainer linked to a specific APT group?

While the campaign shows characteristics of APT operations, no specific group has been officially attributed yet.

What is AMSI bypass in malware?

AMSI bypass refers to techniques used by malware to disable or evade Windows’ Antimalware Scan Interface, preventing detection.

Can antivirus software detect GhostContainer?

Most antivirus tools struggle with detecting GhostContainer due to its memory-only operations and encrypted traffic.

How should IT teams respond if GhostContainer is detected?

Isolate affected systems immediately, review logs for additional compromises, update patches, and engage cybersecurity experts for forensic analysis.

What programming languages does GhostContainer use?

It primarily utilizes .NET technologies within ASP.NET environments and employs encrypted C# payloads.

How can organizations harden Exchange servers against such threats?

By keeping Exchange patches up to date, enabling application whitelisting, and monitoring for unusual web traffic patterns.

Does GhostContainer use fileless malware techniques?

Yes, it primarily operates in memory and avoids writing persistent files to disk, making it harder to detect.

How does GhostContainer retrieve its encryption key?

It hashes the Exchange server’s ASP.NET validation key using SHA-256 to generate a 32-byte AES key for C2 communications.

What industries are at the highest risk from GhostContainer?

Government, defense, telecom, and high-tech manufacturing industries are most likely to be targeted.

Can GhostContainer be used to exfiltrate sensitive emails?

Yes, once inside Exchange servers, attackers can access and export email contents and attachments.

How do attackers deploy GhostContainer initially?

They use publicly available tools like ExchangeCmdPy.py to exploit known vulnerabilities and inject the malicious DLLs.

Why is monitoring HTTP headers important in detecting GhostContainer?

Because GhostContainer hides its control data inside specially crafted HTTP headers, making header analysis a key detection method.