Yemeni hacker (Rami Sanaa) Strikes with Black Kingdom: 1,500 U.S. Systems Hit via ProxyLogon Exploit

A Yemeni hacker, Rami Sanaa, 36, has been formally charged with targeting more than 1,500 US systems, including schools, hospitals, and businesses, using the Black Kingdom ransomware (also known as Pydomer).

The attack exploited the ProxyLogon vulnerability in Microsoft Exchange servers (CVE-2021-26855), which enables an attacker to execute commands without authentication. It is often used in conjunction with another vulnerability (CVE-2021-27065) to further enhance system access.