Exchange 0 day.. Chinese insight
Share this:
IMicrosoft Exchange Server, it’s time to patch. A hacking group is exploiting previously unknown vulnerabilities to steal email files from US-based servers.
Microsoft warned the public about the attacks, which it blamed on a Chinese state-sponsored group dubbed “Hafnium.”
The attacks, which remain ongoing, have been exploiting four vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019. As a result, Microsoft is urging corporate customers to install its patches as soon as possible.
The threat actor used these vulnerabilities to access on-premises Exchange servers, which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments.
One of the vulnerabilities, CVE-2021-26855, is particularly serious because it can exploited remotely, without authentication of any kind. “The attacker only needs to know the server running Exchange and the account from which they want to extract e-mail,”
Meanwhile, a second vulnerability can open the door to remote code execution, enabling an attacker to install malware on a Microsoft Exchange server.
Hafnium has been found stealing information from US targets, including “infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.”Promptly applying today’s patches is the best protection against this attack.”
Microsoft is releasing a patch for Microsoft Exchange Server 2010 to help mitigate the threat. Microsoft Defender, the company’s free antivirus, has also been updated to detect Hafnium’s malware tools.
