Hackers are Targeting Microsoft Exchange servers using exploits to distribute malware. The vulnerabilities allow hackers to bypass detection by sending emails with malware attachments or messages containing malicious links to internal employees. This is done by abusing the Exchange server’s built-in features,  ProxyShell  and ProxyLogon

A clever tactic of using compromised Microsoft Exchange servers to distribute malicious emails to a company’s internal users. By sending an infected email to the victim and then forwarding it to all of the victim’s contacts in their address book. The emails will appear to be sent from the victim’s own account and the subject line will be formatted like a normal email.

Advertisements

Microsoft Exchange infection

The hackers behind this attack are from the ‘TR’ group, it’s a well-known hacker group that distributes emails with malicious attachments that drop malware. Even TR has been spotted in the past using the following file formats in their emails:-

  • Microsoft Office Files (.doc, .xls, .ppt)
  • Rich Text Format (.rtf)
  • Portable Document Format (.pdf)
  • Single File Web Page (.mht)
  • Compiled HTML (.chm)
  • Compiled Help File (.chm or .hlp)
  • Shell Executable files (.exe, .com, or .bat)

The payloads that are used are:-

  • Qbot
  • IcedID
  • Cobalt Strike
  • SquirrelWaffle

Vulnerabilities Exploited

Here are the vulnerabilities that are exploited:-

  • CVE-2021-34473: The pre-auth path confusion
  • CVE-2021-34523: Exchange PowerShell backend elevation-of-privilege
  • CVE-2021-26855: The pre-authentication proxy vulnerability

Keep Exchange servers Hygiene

Threat actors deploy ransomware or install webshells by exploiting both ProxyShell and ProxyLogon vulnerabilities. And these attacks god so bad that without informing the servers’ owners the FBI removed webshells from all the available compromised US-based Microsoft Exchange servers. Make sure Exchange Server is kept upto dated

Advertisements

Indicators of Compromise

SHA-2

  • 4bcef200fb69f976240e7bc43ab3783dc195eac8b350e610ed2942a78c2ba568
  • 4cf403ac9297eeda584e8f3789bebbdc615a021de9f69c32113a7d0817ff
  • 784047cef1ef8150e31a64f23fbb4db0b286117103e076382ff20832db039c0
  • 8163c4746d970efe150d30919298de7be67365c935a35bc2107569fba7a33407
  • 89281a47a404bfae5b61348fb57757dfe6890239ea0a41de46f18422383db092
  • b80bf513afcf562570431d9fb5e33189a9b654ab5cef1a9bf71e0cc0f0580655
  • d770e4c6ba54ec00cf038aa50b838758b8c4162ca53d1ee1198789e3cbc310a

Domain

  • aayomsolutions.co.in/etiste/quasnam[]-4966787
  • aparnashealthfoundation.aayom.com/quasisuscipit/totamet-4966787

URL

  • hxxps://headlinepost.net/3AkrPbRj/x.html
  • hxxps://dongarza.com/gJW5ma382Z/x.html
  • hxxps://taketuitions.com/dTEOdMByori/j.html
  • hxxps://constructorachg.cl/eFSLb6eV/j.html,;
  • hxxps://oel.tg/MSOFjh0EXRR8/j.html
  • hxxps://imprimija.com.br/BIt2Zlm3/y5.html
  • hxxp://stunningmax.com/JR3xNs7W7Wm1/y1.html
  • hxxps: //decinfo.com.br/s4hfZyv7NFEM/y9.html
  • hxxps: //omoaye.com.br/Z0U7Ivtd04b/r.html
  • hxxps://mcdreamconcept.ng/9jFVONntA9x/r.html
  • hxxps://agoryum.com/lPLd50ViH4X9/r.html
  • hxxps://arancal.com/HgLCgCS3m/be.html
  • hxxps://iperdesk.com/JWqj8R2nt/be.html
  • hxxps://grandthum.co.in/9Z6DH5h5g/be.html
Advertisements

IP Address

  • hxxp://24.229.150.54:995/t4
  • 108.179.193.34
  • 69.192.185.238
  • 108.179.192.18
  • 23.111.163.242

Host Indicator

  • C:\Datop\
  • C:\Datop\test.test
  • C:\Datop\test1.test
  • C:\Datop\test2.test
  • C:\Datop\good.good
  • C:\Datop\good1.good
  • C:\Datop\good2.good
  • %windir%\system32\Tasks\aocrimn
  • Scheduled task: aocrimn /tr regsvr32.exe -s “%WorkingDir%\test.test.dll” /SC ONCE /Z /ST