reader comments
6 with 5 posters participating
Microsoft is urging customers to install emergency patches as soon as possible to protect against highly skilled hackers who are actively exploiting four zero-day vulnerabilities in Exchange Server.
The software maker said hackers working on behalf of the Chinese government have been using the previously unknown exploits to hack on-premises Exchange Server software that is fully patched. So far, Hafnium, as Microsoft is calling the hackers, is the only group it has seen exploiting the vulnerabilities, but the company said that could change.
“Even though we’ve worked quickly to deploy an update for the Hafnium exploits, we know that many nation-state actors and criminal groups will move quickly to take advantage of any unpatched systems,” Microsoft Corporate Vice President of Customer Security & Trust Tom Burt wrote in a post published Tuesday afternoon. “Promptly applying today’s patches is the best protection against this attack.”
Burt didn’t identify the targets other than to say they are businesses that use on-premises Exchange Server software. He said that Hafnium operates from China, primarily for the purpose of stealing data from US-based infectious disease researchers, law firms, higher-education institutions, defense contractors, policy think tanks, and nongovernmental organizations.
Burt added that Microsoft isn’t aware of individual consumers being targeted or that the exploits affected other Microsoft products. He also said the attacks are in no way connected to the SolarWinds-related hacks that breached at least nine US government agencies and about 100 private companies.
The zero-days are present in Microsoft Exchange Server 2013, 2016, and 2019. The four vulnerabilities are:
CVE-2021-26855, a server-side request forgery (SSRF) vulnerability that allowed the attackers to send arbitrary HTTP requests and authenticate as the Exchange server.
The attack, Burt said, included the following steps:
- Gain access to an Exchange server either with stolen passwords or by using the zero-days to disguise the hackers as personnel who should have access
- Create a web shell to control the compromised server remotely
- Use that remote access to steal data from a target’s network
As is usual for Hafnium, the group operated from leased virtual private servers in the US.
More details, including indicators of compromise, are available here and here.
Microsoft credited security firms Volexity and Dubex with privately reporting different parts of the attack to Microsoft and assisting in the investigation that followed. Businesses using a vulnerable version of Exchange Server should apply the patches as soon as possible.
