LemonDuck exploiting vulnerable Exchange servers – Commentary on behalf of Rajesh Nataraj, senior threat researcher at Sophos The new technical features uncovered by Sophos researchers include: The abuse of certutil.exe, a Windows Certificate Services command line utility, to download malware that will help the Lemon Duck operators further exploit May 12, 2021 News