{"id":10555,"date":"2021-04-16T05:39:48","date_gmt":"2021-04-16T12:39:48","guid":{"rendered":"https:\/\/wamsinc.com\/?p=10555"},"modified":"2023-12-08T03:19:20","modified_gmt":"2023-12-08T11:19:20","slug":"microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate","status":"publish","type":"post","link":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/","title":{"rendered":"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate"},"content":{"rendered":"\n<p>Microsoft has identified multiple 0-day attacks against on-premises versions of Microsoft Exchange Server. These attacks exploit vulnerabilities that allow attackers to access email accounts. They\u2019re then able to install additional malware that provides them with additional capabilities through these accounts. The attackers include multiple state-sponsored groups that have targeted tens of thousands of Exchange servers throughout the world.<span id=\"more-3633\"><\/span><\/p>\n\n\n\n<p>Microsoft Threat Intelligence Center (MSTIC) is highly confident that the advanced persistent threat (APT) group Hafnium is responsible for the initial attacks based on their procedures, tactics and victimology. This group is based in China and sponsored by that country, although many unrelated groups are also attacking Exchange servers at this time.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>History<\/strong><\/h3>\n\n\n\n<p>A security researcher identified two security flaws in Microsoft Exchange and reported them to Microsoft during early January 2021. Security research firm Volexity detected attacks exploiting these vulnerabilities on January 6 and formally notified Microsoft about them on February 2.&nbsp;<a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/\">Microsoft\u2019s initial reports<\/a>&nbsp;on the attacks indicated that Hafnium was exploiting a vulnerability in Exchange Server. Hafnium continued its attacks while Microsoft began working on patches to remediate the vulnerabilities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Current Status<\/strong><\/h3>\n\n\n\n<p>Microsoft released patches on March 2 to remediate the vulnerability, which affected Exchange Server 2013, 2016 and 2019. The patches don\u2019t retroactively remove backdoors or repair any other type of damage; they only prevent future attacks from succeeding. The day after the patch was released, additional threat actors began scanning Exchange servers and compromising those that were still vulnerable. These actors included the following APT groups:<\/p>\n\n\n\n<ul><li>APT27<\/li><li>Calypso<\/li><li>LuckyMouse<\/li><li>Winnti Group<\/li><\/ul>\n\n\n\n<p>A research team from ESET, a Slovak internet security firm, observed that over 5,000 Exchange servers in 115 countries had web shells that had been compromised by these attacks. Most of these servers were located in Germany, the U.K. and the U.S. In addition to the primary attack, ESET\u2019s team reported that APT groups were conducting secondary attacks with the following hacking tools:<\/p>\n\n\n\n<ul><li>DLTMiner<\/li><li>IIS<\/li><li>Opera Cobalt Strike loader<\/li><li>ShadowPad<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Tracking<\/strong><\/h3>\n\n\n\n<p>Microsoft is tracking the Exchange Server vulnerabilities as the following four Common Vulnerabilities and Exposures (CVEs):<\/p>\n\n\n\n<ul><li>CVE-2021-26855<\/li><li>CVE-2021-26857<\/li><li>CVE-2021-26858<\/li><li>CVE-2021-27065<\/li><\/ul>\n\n\n\n<p>These vulnerabilities have become known collectively as ProxyLogon, since they\u2019re generally based on logging onto Exchange Server through a proxy.<\/p>\n\n\n\n<p>CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability. It allows an attacker to send arbitrary HTTP requests and authenticate them to an Exchange server.<\/p>\n\n\n\n<p>CVE-2021-26857 is a vulnerability involving insecure deserialization in Exchange Server\u2019s Unified Messaging service. This type of vulnerability allows an untrusted user to deserialize data that it controls. In the case of this particular vulnerability, Hafnium was able to execute code on the Exchange server as a system administrator.<\/p>\n\n\n\n<p>CVE-2021-26858 is a vulnerability based on post-authentication arbitrary file writes. It requires an attacker to authenticate itself with an Exchange server through other means like CVE-2021-26855 SSRF or compromising a legitimate administrator\u2019s credentials. Once Exchange Server authenticates the attacker, it can use this vulnerability to write a file to any path on the server.<\/p>\n\n\n\n<p>CVE-2021-27065 is another vulnerability of Exchange Server involving arbitrary file writes after authentication. Once the attacker is authenticated, it can write a file to any path on the server.<\/p>\n\n\n\n<p>The large number of APTs that have exploited vulnerabilities in Exchange Server so soon after their discovery indicates how eager these groups are to compromise popular products. It also demonstrates how important it is to apply security updates as soon as they\u2019re released. Administrators of compromised servers should remove web shells and change credentials to remove additional vulnerabilities created by attackers. In addition, they should examine these servers for signs of malicious activity.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft has identified multiple 0-day attacks against on-premises versions of Microsoft Exchange Server. These attacks exploit vulnerabilities that allow attackers to access email accounts. They\u2019re then able to install additional malware that provides them with additional capabilities through these accounts. The attackers include multiple state-sponsored groups that have targeted tens of thousands of Exchange servers&hellip;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[9],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Microsoft Exchange Server Continues to be Hacked at an Alarming Rate - WAMS Inc<\/title>\n<meta name=\"description\" content=\"WAMS is an Managed IT service provider serving all over South California, WAMS is not just a standard managed service provider that serves small businesses \u2013 we are specialized in managing law firm IT services. Our law firm IT services are designed to solve your practice\u2019s challenges on the ground level and help you provide the maximum value to clients\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate - WAMS Inc\" \/>\n<meta property=\"og:description\" content=\"WAMS is an Managed IT service provider serving all over South California, WAMS is not just a standard managed service provider that serves small businesses \u2013 we are specialized in managing law firm IT services. Our law firm IT services are designed to solve your practice\u2019s challenges on the ground level and help you provide the maximum value to clients\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/\" \/>\n<meta property=\"og:site_name\" content=\"WAMS Inc\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/wamsinc\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-04-16T12:39:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-12-08T11:19:20+00:00\" \/>\n<meta name=\"author\" content=\"WAMS, Inc.\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@wamsinc\" \/>\n<meta name=\"twitter:site\" content=\"@wamsinc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"WAMS, Inc.\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/\"},\"author\":{\"name\":\"WAMS, Inc.\",\"@id\":\"https:\/\/wamsinc.com\/#\/schema\/person\/2f7f97dae31e9ce93353d1ed69ef63d5\"},\"headline\":\"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate\",\"datePublished\":\"2021-04-16T12:39:48+00:00\",\"dateModified\":\"2023-12-08T11:19:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/\"},\"wordCount\":616,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/wamsinc.com\/#organization\"},\"articleSection\":[\"News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/#respond\"]}]},{\"@type\":[\"WebPage\",\"SearchResultsPage\"],\"@id\":\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/\",\"url\":\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/\",\"name\":\"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate - WAMS Inc\",\"isPartOf\":{\"@id\":\"https:\/\/wamsinc.com\/#website\"},\"datePublished\":\"2021-04-16T12:39:48+00:00\",\"dateModified\":\"2023-12-08T11:19:20+00:00\",\"description\":\"WAMS is an Managed IT service provider serving all over South California, WAMS is not just a standard managed service provider that serves small businesses \u2013 we are specialized in managing law firm IT services. Our law firm IT services are designed to solve your practice\u2019s challenges on the ground level and help you provide the maximum value to clients\",\"breadcrumb\":{\"@id\":\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/wamsinc.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/wamsinc.com\/#website\",\"url\":\"https:\/\/wamsinc.com\/\",\"name\":\"WAMS Inc\",\"description\":\"IT Consulting Transformed\",\"publisher\":{\"@id\":\"https:\/\/wamsinc.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/wamsinc.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/wamsinc.com\/#organization\",\"name\":\"WAMS IT Consulting Transformed\",\"url\":\"https:\/\/wamsinc.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/wamsinc.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/wamsinc.com\/wp-content\/uploads\/2022\/07\/website-logo.png\",\"contentUrl\":\"https:\/\/wamsinc.com\/wp-content\/uploads\/2022\/07\/website-logo.png\",\"width\":272,\"height\":59,\"caption\":\"WAMS IT Consulting Transformed\"},\"image\":{\"@id\":\"https:\/\/wamsinc.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/wamsinc\/\",\"https:\/\/x.com\/wamsinc\",\"https:\/\/www.linkedin.com\/company\/wams-inc\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/wamsinc.com\/#\/schema\/person\/2f7f97dae31e9ce93353d1ed69ef63d5\",\"name\":\"WAMS, Inc.\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/wamsinc.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/385798263f5a3433d9f8a71d1b43aab6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/385798263f5a3433d9f8a71d1b43aab6?s=96&d=mm&r=g\",\"caption\":\"WAMS, Inc.\"},\"description\":\"The experts at WAMS, Inc. all have a background in the legal industry and understand the software and the demands that come along with it. That\u2019s why all our clients receive a dedicated account manager and engineer with specific planning that works for your business needs. We didn\u2019t break into the tech world to pinch pennies from clients. We go into every partnership to help their business scale gracefully. Your company growth is our company growth, always.\",\"url\":\"https:\/\/wamsinc.com\/author\/khaightwamsinc-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate - WAMS Inc","description":"WAMS is an Managed IT service provider serving all over South California, WAMS is not just a standard managed service provider that serves small businesses \u2013 we are specialized in managing law firm IT services. Our law firm IT services are designed to solve your practice\u2019s challenges on the ground level and help you provide the maximum value to clients","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/","og_locale":"en_US","og_type":"article","og_title":"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate - WAMS Inc","og_description":"WAMS is an Managed IT service provider serving all over South California, WAMS is not just a standard managed service provider that serves small businesses \u2013 we are specialized in managing law firm IT services. Our law firm IT services are designed to solve your practice\u2019s challenges on the ground level and help you provide the maximum value to clients","og_url":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/","og_site_name":"WAMS Inc","article_publisher":"https:\/\/www.facebook.com\/wamsinc\/","article_published_time":"2021-04-16T12:39:48+00:00","article_modified_time":"2023-12-08T11:19:20+00:00","author":"WAMS, Inc.","twitter_card":"summary_large_image","twitter_creator":"@wamsinc","twitter_site":"@wamsinc","twitter_misc":{"Written by":"WAMS, Inc.","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/#article","isPartOf":{"@id":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/"},"author":{"name":"WAMS, Inc.","@id":"https:\/\/wamsinc.com\/#\/schema\/person\/2f7f97dae31e9ce93353d1ed69ef63d5"},"headline":"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate","datePublished":"2021-04-16T12:39:48+00:00","dateModified":"2023-12-08T11:19:20+00:00","mainEntityOfPage":{"@id":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/"},"wordCount":616,"commentCount":0,"publisher":{"@id":"https:\/\/wamsinc.com\/#organization"},"articleSection":["News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/#respond"]}]},{"@type":["WebPage","SearchResultsPage"],"@id":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/","url":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/","name":"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate - WAMS Inc","isPartOf":{"@id":"https:\/\/wamsinc.com\/#website"},"datePublished":"2021-04-16T12:39:48+00:00","dateModified":"2023-12-08T11:19:20+00:00","description":"WAMS is an Managed IT service provider serving all over South California, WAMS is not just a standard managed service provider that serves small businesses \u2013 we are specialized in managing law firm IT services. Our law firm IT services are designed to solve your practice\u2019s challenges on the ground level and help you provide the maximum value to clients","breadcrumb":{"@id":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/wamsinc.com\/microsoft-exchange-server-continues-to-be-hacked-at-an-alarming-rate\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wamsinc.com\/"},{"@type":"ListItem","position":2,"name":"Microsoft Exchange Server Continues to be Hacked at an Alarming Rate"}]},{"@type":"WebSite","@id":"https:\/\/wamsinc.com\/#website","url":"https:\/\/wamsinc.com\/","name":"WAMS Inc","description":"IT Consulting Transformed","publisher":{"@id":"https:\/\/wamsinc.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/wamsinc.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/wamsinc.com\/#organization","name":"WAMS IT Consulting Transformed","url":"https:\/\/wamsinc.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/wamsinc.com\/#\/schema\/logo\/image\/","url":"https:\/\/wamsinc.com\/wp-content\/uploads\/2022\/07\/website-logo.png","contentUrl":"https:\/\/wamsinc.com\/wp-content\/uploads\/2022\/07\/website-logo.png","width":272,"height":59,"caption":"WAMS IT Consulting Transformed"},"image":{"@id":"https:\/\/wamsinc.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/wamsinc\/","https:\/\/x.com\/wamsinc","https:\/\/www.linkedin.com\/company\/wams-inc\/"]},{"@type":"Person","@id":"https:\/\/wamsinc.com\/#\/schema\/person\/2f7f97dae31e9ce93353d1ed69ef63d5","name":"WAMS, Inc.","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/wamsinc.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/385798263f5a3433d9f8a71d1b43aab6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/385798263f5a3433d9f8a71d1b43aab6?s=96&d=mm&r=g","caption":"WAMS, Inc."},"description":"The experts at WAMS, Inc. all have a background in the legal industry and understand the software and the demands that come along with it. That\u2019s why all our clients receive a dedicated account manager and engineer with specific planning that works for your business needs. We didn\u2019t break into the tech world to pinch pennies from clients. We go into every partnership to help their business scale gracefully. Your company growth is our company growth, always.","url":"https:\/\/wamsinc.com\/author\/khaightwamsinc-com\/"}]}},"_links":{"self":[{"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/posts\/10555"}],"collection":[{"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/comments?post=10555"}],"version-history":[{"count":1,"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/posts\/10555\/revisions"}],"predecessor-version":[{"id":57673,"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/posts\/10555\/revisions\/57673"}],"wp:attachment":[{"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/media?parent=10555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/categories?post=10555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wamsinc.com\/wp-json\/wp\/v2\/tags?post=10555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}