Microsoft Exchange Server Exploits Hit Retail, Government, Education

Mandiant researchers identify a range of victims affected in attacks targeting newly reported Microsoft Exchange Server vulnerabilities.

Attackers targeting four critical Microsoft Exchange Server zero-days patched this week hit a range of organizations across retail, government, and higher education, report the Mandiant researchers who today published their observations of the exploit activity.
Microsoft,
which issued fixes
for the vulnerabilities on March 2, says they have been used in limited and targeted attacks against law firms, infectious disease researchers, defense contractors, policy think tanks, and other victims. It attributes the exploits with high confidence to a group it calls Hafnium, which it believes is state-sponsored and operates out of China.
Mandiant began to see instances of abuse of Microsoft Exchange Server in at least one client environment starting in January, researchers write in their report. Their observations included creation of Web shells for persistent access, remote code execution, and reconnaissance for endpoint security tools. In response, they built threat-hunting campaigns to detect attacker activity on Exchange Server.
While the use of web shells is common amongst threat actors, the parent processes, timing, and victim(s) of these files clearly indicate activity that commenced with the abuse of Microsoft Exchange, they explain in the blog post.
Researchers are now tracking this activity in three clusters — UNC2639, UNC2640, and UNC2643 — and it predicts the number of clusters will grow as it detects more attacks. So far, the team has detected a range of victims including US-based retailers, local governments, a university, and an engineering firm; the writeup notes potential victims may also include a Southeast Asian government and a Central Asian telecom company.
Businesses are urged to patch the vulnerabilities
immediately
.
Read Mandiants
full blog post
for more details on its observations.

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Exchange Server Exploits Hit Retail, Government, Education