Inside the Ransomware Campaigns Targeting Exchange Servers

Security experts discuss the ransomware campaigns taking aim at Microsoft Exchange Server vulnerabilities patched last month.

As organizations around the world scrambled to patch critical Microsoft Exchange Server flaws patched last month, criminals upped the ante with multiple ransomware campaigns targeting vulnerable servers.
News of ransomware activity first emerged on March 12, only 10 days after Microsoft released the patches, and it arrived as researchers noticed an uptick in ransomware attacks following the disclosure of the Exchange Server zero-days. In the week ending March 30, the number of attacks involving the Exchange Server flaws had tripled to more than 50,000 around the world.
Check Point Research
reports
the industries most targeted in these attacks include government and military, manufacturing, and banking and finance. The most affected country is the United States, which makes up 49% of all exploit attempts, the United Kingdom (5%), the Netherlands (4%), and Germany.
The first ransomware variant to appear was DearCry/DoejoCrypt, which copies and encrypts files then overwrites and deletes the originals, a tactic seen earlier in WannaCry ransomware.
DoejoCrypt attacks begin with a variant of the
China Chopper Web shell
being deployed to an Exchange Server post-exploitation, Microsoft explains in a
writeup
. The Web shell writes a batch file to C:WindowsTempxx.bat; on all systems hit with this ransomware, this batch file does a backup of the Security Account Manager (SAM) database and the System and Security registry hives, which give attackers later access to the passwords of local users on the system.
Microsoft points out that because of the configurations that admins normally use on Exchange Servers, many infected systems likely have at least one service or scheduled task configured with a highly privileged account to perform tasks such as backups.
As service account credentials are not frequently changed, this could provide a great advantage to an attacker even if they lose their initial Web shell access due to an antivirus detection, the Microsoft 365 Defender Threat Intelligence Team explains in their blog post.
The encryption header that DoejoCrypt adds to infected files is similar to the header used in the WannaCry attacks, writes Sophos director of engineering Mark Loman
in a blog post
, noting this seems more than a coincidence. Analysis of DoejoCrypt samples revealed the binaries had no defense against antivirus signatures and all ransomware text strings were left in plain sight.
As of Microsofts March 25 post, the DoejoCrypt payload is the most visible outcome of the attackers actions; however, their access to credentials could help them in future campaigns.
I expect anybody who hasnt patched or mitigated the Web shells that were placed over the past month to be in a pretty rough spot, says Juan Guerrero-Saade, principal threat researcher at SentinelOne. This has become available to anybody now, he says of the exploits.
Black KingDom: A Second Campaign Emerges
On Thursday, March 18, Sophos telemetry revealed another ransomware gang targeting vulnerable Exchange servers.
Typically these campaigns start before the weekend because the majority of IT [teams] are understaffed on the weekend or typically dont monitor their network, Loman says in an interview with Dark Reading. The likelihood of this is even greater for organizations that havent prioritized patching their vulnerable on-premises Exchange Server, he adds.
Loman calls the Black KingDom ransomware a bit of an oddball and points out it has virtually nothing in common with DoejoCrypt, aside from the fact it targets the same vulnerability.
Black KingDom is rudimentary and amateurish, he writes in a
blog post
, and likely created by a motivated script kiddie because of the way its constructed. The ransomware was written in Python and compiled in a way that left its original source code embedded within the ransomware binary, which researchers reverse-engineered to dig up the original source code.
Its amateur nature is evident in Black KingDoms approach to file encryption, which Loman calls the most interesting aspect of this ransomware. Normally, ransomware chooses a unique file extension for every file it encrypts, which ensures those file types wont be encrypted twice, he explains. Black KingDom chooses a random file extension for every file it encrypts.
That is really odd, Loman notes. The ransomware also does not check if a file has already been encrypted, a step that other common forms of ransomware usually take.
What we call big game ransomware actors, like Ryuk or REvil or Clop, they all have these types of checks in their code so they dont encrypt the system twice, he explains. Black KingDoms closest approach to this kind of check is a specific ransom note dropped on a victims machine. But if a victim removes the note, the machine can be encrypted again — making decryption much more difficult, even if the ransom is paid.
Further, he adds, Black KingDoms ransom demand was $10,000, a small amount compared with some of todays high ransom demands.
Loman admits he was surprised a comparatively amateurish group was able to pull this off given that Hafnium, the first group linked to any attacks targeting these vulnerabilities, is an advanced group linked to the Chinese government. He speculates Black KingDom may be related to a ransomware of the same name seen last year targeting machines running a vulnerable version of the Pulse Secure VPN concentrator software.
There are several ways to get your ransomware delivered in businesses, but this group was specifically focusing on abusing a vulnerability on Internet-facing devices, he says. In this way, they are making use of the low patching frequency of businesses running on-premises Exchange servers.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Inside the Ransomware Campaigns Targeting Exchange Servers