Exchange 0-day attacks: Hundreds of Thousands of Exchange Servers Affected - Binary Defense

Threat Watch

Threat Watch Exchange 0-day attacks: Hundreds of Thousands of Exchange Servers Affected

Exchange 0-day attacks: Hundreds of Thousands of Exchange Servers Affected

As originally reported by ZDNet and Brian Krebs, exploitation of the four Microsoft Exchange server vulnerabilities (CVE-2021-27065, CVE-2021-26855,CVE-2021-26857, CVE-2021-26858) have resulted in at least 30,000 compromised servers in the United States, and hundreds of thousands worldwide. Former CISA Director Chris Krebs stated that the real number of victims dwarfs the publicly reported number. Microsoft has attributed most of the early attacks using these vulnerabilities to a China-backed hacking group, Hafnium, but since proof-of-concept exploit code has been publicly released, many more unrelated APT and criminal groups have added to the number of attacks. CISA has issued a statement warning of “widespread domestic and international exploitation” of the Microsoft Exchange Server vulnerabilities, and urged agencies to apply a patch or take the system offline. According to Volexity, the attacks started as early as January 6^th, 2021.

ANALYST NOTES

Following the exchange vulnerability announcement, Binary Defense released some of our queries related to detecting this activity, like this query here https://pastebin.com/J4L3r2RS. Additionally, Microsoft has released a tool for detecting this activity called “TestProxyLogon” – https://github.com/microsoft/CSS-Exchange/tree/main/Security. Finally, Binary Defense recommends employing a 24/7 SOC solution, such as Binary Defense’s own Security operations task force, to quickly detect early signs of compromise even when the initial attack vector is an unknown vulnerability.

Sources: https://www.zdnet.com/article/microsoft-exchange-zero-day-attacks-30000-servers-hit-already-says-report/
https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/