informa
/
Vulnerabilities/Threats
Quick Hits

Microsoft Exchange Server Exploits Hit Retail, Government, Education

Mandiant researchers identify a range of victims affected in attacks targeting newly reported Microsoft Exchange Server vulnerabilities.

Attackers targeting four critical Microsoft Exchange Server zero-days patched this week hit a range of organizations across retail, government, and higher education, report the Mandiant researchers who today published their observations of the exploit activity.

Related Content:

More Details Emerge on the Microsoft Exchange Server Attacks

Special Report: How IT Security Organizations Are Attacking the Cybersecurity Problem

New From The Edge: Cybercrime 'Help Wanted': Job Hunting on the Dark Web

Microsoft, which issued fixes for the vulnerabilities on March 2, says they have been used in "limited and targeted" attacks against law firms, infectious disease researchers, defense contractors, policy think tanks, and other victims. It attributes the exploits with high confidence to a group it calls Hafnium, which it believes is state-sponsored and operates out of China.

Mandiant began to see instances of abuse of Microsoft Exchange Server in at least one client environment starting in January, researchers write in their report. Their observations included creation of Web shells for persistent access, remote code execution, and reconnaissance for endpoint security tools. In response, they built threat-hunting campaigns to detect attacker activity on Exchange Server.

"While the use of web shells is common amongst threat actors, the parent processes, timing, and victim(s) of these files clearly indicate activity that commenced with the abuse of Microsoft Exchange," they explain in the blog post.

Researchers are now tracking this activity in three clusters — UNC2639, UNC2640, and UNC2643 — and it predicts the number of clusters will grow as it detects more attacks. So far, the team has detected a range of victims including US-based retailers, local governments, a university, and an engineering firm; the writeup notes potential victims may also include a Southeast Asian government and a Central Asian telecom company.

Businesses are urged to patch the vulnerabilities immediately.

Read Mandiant's full blog post for more details on its observations.

Recommended Reading:
Editors' Choice
Kirsten Powell, Senior Manager for Security & Risk Management at Adobe
Joshua Goldfarb, Director of Product Management at F5