Quick Hits

Microsoft Exchange Server Exploit Code Posted to GitHub

The proof-of-concept tool, which contained exploits for two Exchange Server vulnerabilities, was quickly removed from GitHub.

Exploit code for two Microsoft Exchange Server vulnerabilities under attack was published to GitHub earlier today. The Microsoft-owned platform quickly took down the proof-of-concept (PoC). 

Related Content:

Microsoft Exchange Server Attack Escalation Prompts Patching Panic

Special Report: How IT Security Organizations Are Attacking the Cybersecurity Problem

New From The Edge: How to Protect Vulnerable Seniors From Cybercrime

The PoC combines CVE-2021-26855 and CVE-202127065, two of the four Exchange Server zero-days that attackers are using to break into Exchange Servers and deploy Web shells to steal data from target businesses. Since the flaws were patched on March 2, attacks have rapidly increased. At least 10 advanced persistent threat groups have started to weaponize these vulnerabilities to target servers. 

This marks the first fully functional exploit code to appear for the vulnerabilities, according to a new report from The Record, which notes that the PoC was published to GitHub by a Vietnamese security researcher. Other security researchers have confirmed it works, albeit with some adjustments. 

GitHub removed the code hours after its publication. In a statement to Vice, a spokesperson said the PoC code was removed because the vulnerability it exploits is under active attack. 

Read the full report for more details.

Editors' Choice
Evan Schuman, Contributing Writer, Dark Reading
Tara Seals, Managing Editor, News, Dark Reading
Jeffrey Schwartz, Contributing Writer, Dark Reading