Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/8/2021
05:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Microsoft Exchange Server Attack Escalation Prompts Patching Panic

US government officials weigh in on the attacks and malicious activity, which researchers believe may be the work of multiple groups.

The critical Exchange Server vulnerabilities patched last week by Microsoft are being weaponized in widespread attacks against organizations worldwide. Attacks have escalated over the past two weeks, prompting responses from US government and the security community. 

Related Content:

Microsoft Fixes Exchange Server Zero-Days Exploited in Active Attacks

Special Report: How IT Security Organizations Are Attacking the Cybersecurity Problem

New From The Edge: Realistic Patch Management Tips, Post-SolarWinds

News of the four vulnerabilities emerged on March 2, when Microsoft issued patches for CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. These flaws affect Microsoft Exchange Server versions 2013, 2016, and 2019, though the company notes Microsoft Exchange Server 2010 is being updated for Defense in Depth purposes. Exchange Online is not affected.

Microsoft, which learned of these vulnerabilities in early January, initially reported they were being exploited in "limited and targeted attacks" by Hafnium, a group it believes is state-sponsored and operates out of China. Officials said this was the only actor it had seen weaponizing these exploits, which it used to primarily target organizations in the US. 

But other security experts say there are likely multiple threat groups behind the wave of malicious activity going after Exchange Servers.

This activity accelerated toward the end of February, when Volexity researchers who found some of the zero-days noticed an increase in instances of remote code execution (RCE). In all cases, attackers were writing Web shells to disk and doing operations to dump credentials, add user accounts, steal copies of Active Directory databases, and move laterally to other systems.

What had previously been "low and slow" activity had quickly escalated into a lot of noise. 

"While it started out as targeted espionage campaign, they engaged in reckless and dangerous behavior by scanning/compromising Exchange servers across the entire IPv4 address space with webshells that can now be used by other actors, including ransomware crews," Dmitri Alperovitch, chairman of the Silverado Policy Accelerator and cofounder of CrowdStrike, said in a tweet

Intelligence from multiple sources indicates that the malicious activity has grown more widespread since March 2. At least 30,000 organizations in the US have been affected, KrebsOnSecurity reports. Since early March, Kaspersky has detected related attacks on more than 1,200 users, "with this number continually growing." Most of these targets are in Germany (26.9%), with others in Italy (9%), Austria (5.72%), Switzerland (4.81), and the US (4.73%), researchers report. The European Banking Authority is among organizations affected outside the US. 

Katie Nickels, director of intelligence for Red Canary, says they began to see an increase in suspicious Web shell activity targeting Exchange servers on Feb. 28, days before Microsoft's disclosure of Hafnium activity. Red Canary's data shows multiple clusters of Web shell activity; for example, Web shells they saw dropped from Feb. 28 through March 3 acted differently from Web shells they saw dropped on March 5. 

"Each of these clusters look a bit different, which leads us to assess there may be multiple adversaries exploiting these vulnerabilities," Nickels says. "One thing we don't know right now is if these adversaries are cooperating somehow and just using different TTPs, or if they are distinct adversaries who are not coordinating." 

Multiple Attack Groups Likely Involved

Red Canary isn't the only security firm tracking this activity in "clusters." In a blog post posted last week, Mandiant researchers explained how they are tracking the attacks in three clusters: UNC 2639, UNC2640, and UNC2643. While Microsoft initially attributed this activity to Hafnium, the rapid acceleration of activity calls into question whether other groups might be responsible.

"Hafnium is definitely not the only actor involved in this activity," Kaspersky researchers say in an email to Dark Reading, noting there were other attackers using some of these exploits before a patch was released. After March 2, they say, the number of attackers has increased. 

With each day since the patches were released, Kaspersky researchers report a higher number of automated attempts of at least one of the flaws (CVE-2021-26855). Their intelligence shows the attacks peaked on March 5 and have since plateaued; however, they note this isn't unusual. 

"This is a typical reaction we see in the wild, especially if a working exploit has also been produced," they explain. "It's a sort of race against time between attackers looking to capitalize on the 'patch gap' and defenders trying to mitigate the risk." They note attackers are most likely using various means to set up persistent access, which they can use as they like in the future.

Most of the Web shells Red Canary has observed provide attackers with an initial foothold. However, Nickels notes that fewer attacks conduct significant post-exploitation beyond that foothold. Researchers have seen some activity clusters execute commands to learn more about the environment; others have added scheduled tasks for persistence and beaconed back to command-and-control domains. Microsoft initially reported that Hafnium compressed stolen data and exported mailbox data; however, this is not occurring on every compromised server. 

"The challenge of having multiple activity clusters exploiting these vulnerabilities is that each of those could represent different adversaries with different intents," Nickels says. The fact that much of this activity is noisy and visible to defenders indicates some adversaries don't care much about hiding their presence. She notes the team is cautious to clearly distinguish clusters rather than attributing all activity to China, which she says is an assessment they cannot make. 

In his Twitter thread, Alperovitch says this activity "deserves a significant response from the Biden administration," especially if damaging ransomware attacks emerge in coming weeks. 

White House press secretary Jen Psaki mentioned the activity in a March 5 press briefing, and the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert urging organizations to patch the vulnerabilities "immediately" or disconnect their Microsoft Exchange Servers.

"We are concerned that there are a large number of victims and are working with our partners to understand the scope of this," Psaki said, later adding that "network owners also need to consider whether they have already been compromised and should immediately take appropriate steps."

National security advisor Jake Sullivan said in a tweet that officials are closely tracking Microsoft patches for these vulnerabilities as well as watching for potential compromises at US think tanks and defense industrial base entities. He encouraged network owners to patch as soon as possible, as did former CISA director Chris Krebs, who calls this "the real deal" in a tweet.

"If your organization runs an [Outlook Web Access] server exposed to the Internet, assume compromise between 02/26-03/03," Krebs said.

What Organizations Should Do in Response

The most obvious advice is to apply patches for these critical flaws, which will protect targets from potential compromise. But as Nickels points out, installing patches won't tell you if you've already been a target – let alone remediate an active attack.

"If security teams can gather visibility into process lineage and command line parameters associated with the Windows IIS worker process, then they may be able to hunt or build detection for this and other Exchange web shell activity," she says. Microsoft, Volexity, and other companies have shared information that can help businesses check for compromise.

Should they discover an attack, IT and security teams are advised to run a "full and thorough" incident response process, Kaspersky researchers say. 

Most of the businesses that rely on Exchange server are late mainstream organizations, small- to medium-sized businesses, and some large enterprises that use on-premise Exchange for automated email systems, says Gartner research vice president Peter Firstbrook. Those who are still on-premise because they lack budget and time to migrate are most at risk, he notes.

"Risk-based patching is critical," Firstbrook says, adding that "full exposure of corporate email is a big risk to most organizations, so this should have been a priority." The key is knowing which flaws are high risk and being able to prioritize them, which requires a strong vulnerability and patch management program – something often lacking in small companies with slim IT budgets. 

As with other older enterprise software, patching Exchange server can be a difficult process, especially if the business is behind on updates. For this reason, Microsoft has provided mitigations for those that can't patch quickly. Officials note these mitigations do not provide full protection, nor do they provide remediation if an Exchange server has already been compromised. CISA has also issued an alert for the alternative mitigations.

Microsoft responded to request for comment stating it's working with CISA, other government agencies, and security companies to continue providing guidance and mitigation steps. 

"The best protection is to apply updates as soon as possible across all impacted systems," a spokesperson says, noting that affected businesses should contact Microsoft's support teams for additional help and resources.
Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: "Elon, I think our cover's been blown."
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31597
PUBLISHED: 2021-04-23
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
CVE-2021-2296
PUBLISHED: 2021-04-22
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2021-2297
PUBLISHED: 2021-04-22
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2021-2298
PUBLISHED: 2021-04-22
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...
CVE-2021-2299
PUBLISHED: 2021-04-22
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful atta...