Microsoft confirms hackers are actively exploiting Exchange zero-day flaws

Microsoft Trade server is a kind of enterprise staples, nevertheless it’s additionally a key goal for cybercriminals. Final week, GTSC reported assaults had begun chaining two new zero-day Trade exploits as a part of coordinated assaults. 

Whereas data is restricted, Microsoft has confirmed in a weblog submit that these exploits have been utilized by a suspected state-sponsored menace actor to focus on fewer than 10 organizations and efficiently exfiltrate information. 

The vulnerabilities themselves have an effect on Trade Server 2013, 2016, and 2019. The primary, CVE-2022-41040 is a Server-Facet Request Forgery (SSRF) vulnerability, and the second CVE-2022-41082 permits distant code execution if the attacker has entry to PowerShell. 

When mixed collectively, an attacker can use the SSRF flag to remotely deploy malicious code to a goal community. 

On-premises Microsoft Trade servers: An irresistible goal 

On condition that 65,000 corporations use Microsoft Trade, enterprises should be ready for different menace actors to use these vulnerabilities. In spite of everything, this isn’t the primary time on-premises Trade servers have been focused as a part of an assault. 

In March final 12 months, a Chinese language menace actor known as Hafnium exploited 4 zero-day vulnerabilities in on-premises variations of Trade Server, and efficiently hacked no less than 30,000 U.S. organizations.

Throughout these assaults, Hafnium stole person credentials to realize entry to enterprise’s alternate servers and deployed malicious code to realize distant admin entry, and start harvesting delicate information. 

Whereas solely a handful of organizations have been focused by this unknown state-sponsored menace actor, Trade is a high-value goal for cybercriminals as a result of it gives a gateway to plenty of worthwhile data. 

“Trade is a juicy goal for menace actors to use for 2 major causes,” mentioned Travis Smith, vp of malware menace analysis at Qualys. 

“First, Trade is an e mail server, so it should be linked on to the web. And being straight linked to the web creates an assault floor which is accessible from wherever on the planet, drastically growing its threat of being attacked,” Smith mentioned. 

Secondly, Trade is a mission crucial operate — organizations can’t simply unplug or flip off e mail with out severely impacting their enterprise in a unfavourable method,” Smith mentioned. 

So how dangerous is it? 

One of many major limitations of those vulnerabilities from an attacker’s perspective is that they should have authenticated entry to an Trade server to leverage the exploits. 

Whereas this can be a barrier, the truth is that login credentials are simple for menace actors to reap, whether or not by means of buying one of many 15 billion passwords uncovered on the darkish net, or tricking workers into handing them over through phishing emails or social engineering assaults. 

At this stage, Microsoft anticipates that there will likely be an uptick in exercise across the menace. 

In a weblog launched on the thirtieth of September, Microsoft famous “it’s anticipated that comparable threats and total exploitation of those vulnerabilities will enhance, as safety researchers and cybercriminals undertake the printed analysis into their toolkits and proof of idea code turns into obtainable.” 

Tips on how to cut back the chance 

Though there’s no patch obtainable for the updates but, Microsoft has launched a listing of remediation actions that enterprises can take to safe their environments. 

Microsoft recommends that enterprises ought to evaluation and apply the URL Rewrite Directions in its Microsoft Safety Response middle submit, and has launched a script to mitigate the SSRF vulnerability. 

The group additionally means that organizations utilizing Microsoft 365 Defender take the next actions: 

• Activate cloud-delivered safety in Microsoft Defender Antivirus. 
• Activate tamper safety. 
• Run EDR in block mode. 
• Allow community safety.
• Allow investigation and remediation in full automated mode.
• Allow community safety to stop customers and apps from accessing malicious domains.

Not directly, organizations may also look to cut back the chance of exploitation by emphasizing safety consciousness and educating workers about social engineering threats, and the significance of correct password administration to cut back the prospect of a cybercriminal gaining administrative entry to Trade. 

Lastly, it’s possibly time for organizations to think about whether or not operating an on-premises Trade server is important.