Microsoft Exchange Server Exploits Hit Retail, Government, EducationMicrosoft Exchange Server Exploits Hit Retail, Government, Education
Mandiant researchers identify a range of victims affected in attacks targeting newly reported Microsoft Exchange Server vulnerabilities.
March 6, 2021
Attackers targeting four critical Microsoft Exchange Server zero-days patched this week hit a range of organizations across retail, government, and higher education, report the Mandiant researchers who today published their observations of the exploit activity.
Microsoft, which issued fixes for the vulnerabilities on March 2, says they have been used in "limited and targeted" attacks against law firms, infectious disease researchers, defense contractors, policy think tanks, and other victims. It attributes the exploits with high confidence to a group it calls Hafnium, which it believes is state-sponsored and operates out of China.
Mandiant began to see instances of abuse of Microsoft Exchange Server in at least one client environment starting in January, researchers write in their report. Their observations included creation of Web shells for persistent access, remote code execution, and reconnaissance for endpoint security tools. In response, they built threat-hunting campaigns to detect attacker activity on Exchange Server.
"While the use of web shells is common amongst threat actors, the parent processes, timing, and victim(s) of these files clearly indicate activity that commenced with the abuse of Microsoft Exchange," they explain in the blog post.
Researchers are now tracking this activity in three clusters — UNC2639, UNC2640, and UNC2643 — and it predicts the number of clusters will grow as it detects more attacks. So far, the team has detected a range of victims including US-based retailers, local governments, a university, and an engineering firm; the writeup notes potential victims may also include a Southeast Asian government and a Central Asian telecom company.
Businesses are urged to patch the vulnerabilities immediately.
Read Mandiant's full blog post for more details on its observations.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023