Microsoft on Friday released alternative mitigation measures for organizations who have not been able to immediately apply emergency out-of-band patches released earlier this week that address vulnerabilities being exploited to siphon e-mail data from corporate Microsoft Exchange servers.
“These mitigations are not a remediation if your Exchange servers have already been compromised, nor are they full protection against attack,” Microsoft warned in a blog post. “We strongly recommend investigating your Exchange deployments using the hunting recommendations here to ensure that they have not been compromised. We recommend initiating an investigation in parallel with or after applying one of the following mitigation strategies.”
Microsoft also provided a nmap script to help customers discover vulnerable servers within their infrastructure.
Security researchers have warned that multiple cyber-espionage groups have been targeting vulnerable Exchange servers. Some reports suggest that 30,000 or more organizations may have been hacked via the Exchange security holes.
Analysts say that HAFNIUM, a state-sponsored hacking group operating out of China, has been on an an active hacking spree with a massive espionage campaign underway to siphon data from organizations globally.
“This is the real deal. If your organization runs an OWA server exposed to the internet, assume compromise between 02/26-03/03,” Ex-CISA Chief Chris Krebs tweeted. “Check for 8 character aspx files in C:inetpubwwwrootaspnet_clientsystem_web. If you get a hit on that search, you’re now in incident response mode.”
The U.S. Cybersecurity and Infrastructure Security (CISA) also issued an alert Friday, urging organizations to upgrade their on-premises Microsoft Exchange servers to the latest supported version.
Cybersecurity firm Volexity, which was credited by Microsoft for reporting different parts of the attack chain, has published a blog post with technical details and a video demonstrating exploitation in action, along with known attacker IP addresses connected to the attacks. Volexity said it detected anomalous activity from two of its customers’ Microsoft Exchange servers in January 2021, which led to discovery of the attacks.