Name: Microsoft Exchange zero-day attacks: 30,000 servers hit already, says report | ZDNet
Brand: zdnet.com
SKU: zdnet-com-526
Availability: OnlineOnly

critic

Microsoft Exchange zero-day attacks: 30,000 servers hit already, says report | ZDNet

preview

By| March 8, 2021 -- 11:53 GMT (03:53 PST)| Topic:Four previously unknown or 'zero-day' vulnerabilities in Microsoft Exchange Server are now being used in widespread attacks against thousands of organisations with potentially tens of thousands of organisations affected, according to security researchers. The bugs are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. Microsoft, which , attributed the attacks to a newly discovered hacking team it calls Hafnium, most likely a China-backed group. Microsoft said they were "limited targeted attacks" but warned they could be more widely exploited in the near future.&nbsp; &nbsp; Also:Since then, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) has&nbsp; or to simply disconnect vulnerable servers after seeing "active exploitation" of the vulnerabilities. In other words, patch now or cut off a vital communications tool.&nbsp; Microsoft urged Exchange customers, which range from large enterprise to small businesses, to apply the patches immediately because "nation-state actors and criminal groups will move quickly to take advantage of any unpatched systems."CISA over the "aware of widespread domestic and international exploitation" of Microsoft Exchange Server vulnerabilities and urged the scanning of Exchange Server logs with Microsoft's IOC detection tool to help determine compromise.&nbsp; History suggests many organizations do not update their software when vulnerabilities are found. Microsoft last year warned Exchange server customers to patch the critical flaw CVE-2020-0688 but found that months afterwards , despite nation-state attackers exploiting the bug from the outset.Chris Krebs, the , reckons government agencies and small businesses will be more affected by these attacks than large enterprise.&nbsp; He believes the Exchange bugs will disproportionately affect small businesses and organizations in the education sector as well as state and local governments.&nbsp; "Incident response teams are BURNED OUT &amp; this is at a really bad time," he wrote.&nbsp;The Hafnium attackers deployed "web shells" on compromised Exchange servers for the purpose of stealing data and installing more malware. Web shells are small scripts that provide a basic interface for remote access to a compromised system.&nbsp; , author of Krebsonsecurity, the Hafnium hackers have accelerated attacks on vulnerable Exchange servers since Microsoft released the patches. His sources told him that 30,000 organisations in the US have been hacked as part of this campaign.&nbsp; SEE: "The intruders have left behind a "web shell," an easy-to-use, password-protected hacking tool that can be accessed over the Internet from any browser. The web shell gives the attackers administrative access to the victim's computer servers," notes Krebs.&nbsp; Volexity, a Washington DC-based security firm, said the Hafnium attacks started as early as January 6, 2021.&nbsp;By| March 8, 2021 -- 11:53 GMT (03:53 PST)| Topic:

By| March 8, 2021 -- 11:53 GMT (03:53 PST)| Topic:Four previously unknown or 'zero-day' vulnerabilities in Microsoft Exchange Server are now being used in widespread attacks against thousands of organisations with potentially tens of thousands of organisations affected, according to security researchers. The bugs are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. Microsoft, which , attributed the attacks to a newly discovered hacking team it calls Hafnium, most likely a China-backed group. Microsoft said they were "limited targeted attacks" but warned...

public

Liam Tung

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

Microsoft Exchange zero-day attacks: 30,000 servers hit already, says report | ZDNet

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS