Name: News and Advice on the World's Latest Innovations | ZDNET
Brand: zdnet.com
SKU: zdnet-com-537
Availability: OnlineOnly

critic

News and Advice on the World's Latest Innovations | ZDNET

preview

/&gt;Ransomware attackers are now targeting Exchange servers that haven’t received the patches that Microsoft released last week.Microsoft has issued an alert that hackers using a strain of ransomware known as DearCry are now targeting unpatched Exchange servers still exposed to four vulnerabilities that were being exploited by suspected Chinese government hackers. Microsoft is warning Exchange customers once again to apply the emergency patches it released last week for critical flaws affecting on-premise Exchange email servers.&nbsp; Microsoft urged customers on due to the risk that more cybercriminals and state-backed hackers would exploit the flaws in coming weeks and months.&nbsp; SEE: (TechRepublic Premium)It said existing attacks were being carried out by a Chinese hacking group it calls Hafnium. However, security vendor ESET reported yesterday that at to exploit flaws in unpatched Exchange servers. &nbsp;&nbsp; And now cyber criminals are looking to feed off the Exchange bugs. Ransomware attackers spreading a strain called DearCry are attempting to install the malware after compromising Exchange servers, according to Microsoft.&nbsp; "We have detected and are now blocking a new family of ransomware being used after an initial compromise of unpatched on-premises Exchange Servers. Microsoft protects against this threat known as Ransom:Win32/DoejoCrypt.A, and also as DearCry," . Ransom:Win32/DoejoCrypt.A is the name under which Microsoft's Defender antivirus will detect the new threat. &nbsp; Microsoft added that customers using Microsoft Defender antivirus that use automatic updates don't need to take additional action after patching the Exchange server.&nbsp; Microsoft appears to be treating this set of Exchange bugs as an urgent one to fix and last week provided further security updates to address the flaw in unsupported versions of Exchange.&nbsp; The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) .&nbsp; CISA further said it is "aware of threat actors using open-source tools to search for vulnerable Microsoft Exchange Servers and advises entities to investigate for signs of a compromise from at least September 1, 2020." The bugs affect Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019, but not Exchange Online.&nbsp; The attackers were using the bugs to comprise Exchange servers and deploy web shells to steal data and maintain access to servers after initial compromise. Web shells are small scripts that provide a basic interface for remote access to a compromised system.&nbsp; Microsoft has released a that admins can use to check for the presence of web shells on Exchange servers.&nbsp; That script could come in handy when kicking attackers off a previously compromised system. Microsoft security researcher Kevin Beaumont .&nbsp; SEE: CISA has advised it "is aware of widespread domestic and international exploitation of these vulnerabilities" and urged Exchange admins to run Microsoft's Test-ProxyLogon.ps1 script.&nbsp; Independent security researchers behind the they've seen attacks on companies in Canada, Denmark, United States, Australia, Austria, with the first victims observed on March 9 — just seven days after Microsoft issued the patch and warned Exchange customers to patch immediately.&nbsp; CISA strongly recommends organizations run the Test-ProxyLogon.ps1 script as soon as possible to help determine whether their systems are compromised.

/&gt;Ransomware attackers are now targeting Exchange servers that haven’t received the patches that Microsoft released last week.Microsoft has issued an alert that hackers using a strain of ransomware known as DearCry are now targeting unpatched Exchange servers still exposed to four vulnerabilities that were being exploited by suspected Chinese government hackers. Microsoft is warning Exchange customers once again to apply the emergency patches it released last week for critical flaws affecting on-premise Exchange email servers.&nbsp; Microsoft urged customers on due to the risk that more...

public

Liam Tung

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

News and Advice on the World's Latest Innovations | ZDNET

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS