Exchange Mail Server Flaws Disclosed - More Attacks on Government Agencies

 Directly after Microsoft revealed four new zero-day flaws in Microsoft Exchange, Chinese hacker groups started scrambling to find vulnerable machines, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency warning of “active exploitation.”

ESET cybersecurity company noted that these vulnerabilities are being exploited not only by a hacker grown known as HAFNIUM but also LuckyMouse, Tick, and Calypso targeting servers located in the U.S., Europe, Asia, and the Middle East. Another threat researcher group estimates around 2,000 vulnerable Microsoft Exchange Servers.

Data Breach Today reported that;

“While Microsoft has said that a Chinese-linked hacking group that has been exploiting the vulnerabilities in Exchange is known to target infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and non-government organizations, FireEye analysts note that other groups appear to have set their sights on local government networks.”

What is Microsoft Doing About It?

Microsoft first learned about the zero-day exploits on January 5th. Since then, at least ten hacker groups have dug in using these bugs to infiltrate government agencies, corporations, and medical providers. From research performed by ESET, it appears that the threat actors knew about the exploits even before Microsoft did.

Microsoft issued patches to fix the four vulnerabilities this past week. However, not all servers have received the update yet leaving some customers at risk. However, on March 4th, two days after Microsoft issued the patch, new attacks were noted by Data Breach Today:

• “Tonto Team, also known as CactusPete, hacking email servers of a procurement firm and a consulting company specializing in software development and cybersecurity, both based in Eastern Europe.
• An unknown group using the Opera browser to target about 650 servers, mostly in the U.S., Germany, the U.K., and other European countries, and then install the penetration testing tool Cobalt Strike.
• An unknown group installed web shells in four email servers in Asia and South America that, in turn, downloaded variants of the IIS backdoor, which is a rootkit for Microsoft Internet Information Services.
• The Mikroceen APT group, aka Vicious Panda, on March 4, compromising the Exchange server of a utility company in Central Asia and injecting versions of the password-grabbing Mimikatz tool.
• The DLTMiner gang on March 5 deploying PowerShell downloaders on email servers that were previously targeted using Exchange vulnerability exploits. ESET theorizes that DLTMiner is hijacking web shells installed by other threat groups.”

Help for Victims

Data Breach Today lists the four new vulnerabilities “Previously, ESET reported that about five APT groups have been exploiting the four Exchange vulnerabilities -  CVE-2021-26855,  CVE-2021-26857,  CVE-2021-26858, and  CVE-2021-27065  - but had not named the allegedly involved groups.”

In the ESET report, they noted that at least 5,000 government and private email accounts in 115 countries had been hacked using these flaws. Another IT research firm says it has a list of 86,000 Microsoft Exchange Servers worldwide that have been targeted.

According to Data Breach Today, “To assist victims, Unit 221B has created a web-based service called  Check My OWA  - for Outlook Web Access or Outlook Web App - designed to help organizations identify whether their email systems were infected in the first wave of attacks.”

How to Keep Microsoft Exchange Safe