Attackers also are deploying ProxyShell and abusing the vulnerabilities in stealthier manner, researchers say.