Exchange Mail Server Flaws Disclosed - More Attacks on Government Agencies

Posted on by Dawna M. Roberts in News March 23, 2021
https://content.infopay.net/storage/thumbnails/6WkC9IuK7H18ieXy91eZ6cKBpbqwQ1TYvGIesIZ2.jpg

 Directly after Microsoft revealed four new zero-day flaws in Microsoft Exchange, Chinese hacker groups started scrambling to find vulnerable machines, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency warning of “active exploitation.”

ESET cybersecurity company noted that these vulnerabilities are being exploited not only by a hacker grown known as HAFNIUM but also LuckyMouse, Tick, and Calypso targeting servers located in the U.S., Europe, Asia, and the Middle East. Another threat researcher group estimates around 2,000 vulnerable Microsoft Exchange Servers.

Data Breach Today reported that;

“While Microsoft has said that a Chinese-linked hacking group that has been exploiting the vulnerabilities in Exchange is known to target infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and non-government organizations, FireEye analysts note that other groups appear to have set their sights on local government networks.”

What is Microsoft Doing About It?

Microsoft first learned about the zero-day exploits on January 5th. Since then, at least ten hacker groups have dug in using these bugs to infiltrate government agencies, corporations, and medical providers. From research performed by ESET, it appears that the threat actors knew about the exploits even before Microsoft did.

Microsoft issued patches to fix the four vulnerabilities this past week. However, not all servers have received the update yet leaving some customers at risk. However, on March 4th, two days after Microsoft issued the patch, new attacks were noted by Data Breach Today:

  • “Tonto Team, also known as CactusPete, hacking email servers of a procurement firm and a consulting company specializing in software development and cybersecurity, both based in Eastern Europe.
  • An unknown group using the Opera browser to target about 650 servers, mostly in the U.S., Germany, the U.K., and other European countries, and then install the penetration testing tool Cobalt Strike.
  • An unknown group installed web shells in four email servers in Asia and South America that, in turn, downloaded variants of the IIS backdoor, which is a rootkit for Microsoft Internet Information Services.
  • The Mikroceen APT group, aka Vicious Panda, on March 4, compromising the Exchange server of a utility company in Central Asia and injecting versions of the password-grabbing Mimikatz tool.
  • The DLTMiner gang on March 5 deploying PowerShell downloaders on email servers that were previously targeted using Exchange vulnerability exploits. ESET theorizes that DLTMiner is hijacking web shells installed by other threat groups.”

Help for Victims

Data Breach Today lists the four new vulnerabilities “Previously, ESET reported that about five APT groups have been exploiting the four Exchange vulnerabilities -  CVE-2021-26855CVE-2021-26857CVE-2021-26858, and  CVE-2021-27065  - but had not named the allegedly involved groups.”

In the ESET report, they noted that at least 5,000 government and private email accounts in 115 countries had been hacked using these flaws. Another IT research firm says it has a list of 86,000 Microsoft Exchange Servers worldwide that have been targeted.

According to Data Breach Today, “To assist victims, Unit 221B has created a web-based service called  Check My OWA  - for Outlook Web Access or Outlook Web App - designed to help organizations identify whether their email systems were infected in the first wave of attacks.”

How to Keep Microsoft Exchange Safe

The best way to keep your Microsoft Exchange Server safe is to update it regularly with security patches. Stay on top of cybersecurity news and watch for any zero-day flaws or other vulnerabilities discovered and monitor your corporate network 24/7 with a particular interest in any intrusions or unusual activity in email accounts.
About the Author
IDStrong Logo

Related Articles

Instagram Vulnerability Allowed Hackers Access to Control Your Phone

Security experts Check Point Research discovered a critical vulnerability while examining Instagram’s c... Read More

Alien Malware Infects More than 226 Mobile Apps and Steals Bank Data

As reported on September 24, 2020, by ZDNet and ThreatPost, a new strain of malware named “Alien” is ... Read More

Universal Health Systems Hit by Ransomware Attack

Universal Health Systems (UHS), a Fortune 500 company owning more than 400 hospitals across the country, ... Read More

Exchange Server Bug Exposes a Big Risk to Hackers

Months after Microsoft released a patch to fix a serious flaw in MS Exchange Server, more than 61% of the... Read More

FREE IDENTITY THREAT SCAN
Scan Your Records for Breaches, Leaks & Exposures!