CISA warns about recently discovered vulnerabilities in Microsoft Exchange Server
- Published: Thursday, 04 March 2021 08:24
The US Cybersecurity & Infrastructure Security Agency (CISA) has released an alert concerning vulnerabilities in Microsoft Exchange Server. Microsoft issued its own alert highlighting this issue earlier in the week.
The CISA alert, ‘AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities’, says that:
“CISA partners have observed active exploitation of vulnerabilities in Microsoft Exchange Server products. Successful exploitation of these vulnerabilities allows an unauthenticated attacker to execute arbitrary code on vulnerable Exchange Servers, enabling the attacker to gain persistent system access, as well as access to files and mailboxes on the server and to credentials stored on that system. Successful exploitation may additionally enable the attacker to compromise trust and identity in a vulnerable network. Microsoft released out-of-band patches to address vulnerabilities in Microsoft Exchange Server. The vulnerabilities impact on-premises Microsoft Exchange Servers and are not known to impact Exchange Online or Microsoft 365 (formerly O365) cloud email services.
"This Alert includes both tactics, techniques and procedures (TTPs) and the indicators of compromise (IOCs) associated with this malicious activity. To secure against this threat, CISA recommends organizations examine their systems for the TTPs and use the IOCs to detect any malicious activity. If an organization discovers exploitation activity, they should assume network identity compromise and follow incident response procedures. If an organization finds no activity, they should apply available patches immediately and implement the mitigations in this Alert.”
Microsoft’s alert confirms that it has detected multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server in ‘limited and targeted attacks’. The Microsoft Threat Intelligence Center attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures.
Read the alerts: