Microsoft Exchange Server Zero-Day Exploit Could Have Thousands of Victims

Chinese hackers have infiltrated hundreds of thousands of on-premises Microsoft Exchange Server instances throughout the world, according to multiple reports. Microsoft, which identified the attackers as Hafnium, is urging organizations running the email server to install newly released patches.

Hafnium is a nation-state actor, warned Tom Burt, Microsoft’s corporate VP for customer security and trust. The group has penetrated more than 30,000 organizations in the U.S., Brian Krebs of the respected KrebsOnSecurity site reported Friday night.

Krebs said the hackers may have breached hundreds of thousands of Microsoft Exchange Servers throughout the world. Krebs cited two anonymous sources who briefed U.S. security advisors.

A Wired report on Saturday confirmed Krebs findings. The impact of the Microsoft Exchange Server vulnerability could be “absolutely massive,” an informed former national security advisor told Wired. “We’re talking thousands of servers compromised per hour, globally.”

If the predicted number of victims are indeed that many, it could impact more organizations than the SolarWinds attack. That massive attack by Russian hackers, revealed in December, may have impacted as many as 18,000 organizations.

White House Concerned

White House press secretary Jen Psaki addressed the issue in Friday’s daily briefing, describing the vulnerabilities as significant.

“We’re concerned that there are a large number of victims,” Psaki said.

Since Microsoft revealed the zero-day exploit days earlier, Hafnium has “stepped up” its attacks on unpatched Exchange Servers, Krebs noted.  Consequently, they may have “seized control over hundreds of thousands of Microsoft Exchange Servers worldwide,” he added.

Jake Sullivan, President Joe Biden’s National Security Advisor, echoed Microsoft’s call for organizations to patch their Microsoft Exchange Server instances.

“We are closely tracking Microsoft’s emergency patch for previously unknown vulnerabilities in Exchange Server software and reports of potential compromises of U.S. think tanks and defense industrial base entities,” Sullivan tweeted. “We encourage network owners to patch ASAP.”

We are closely tracking Microsoft’s emergency patch for previously unknown vulnerabilities in Exchange Server software and reports of potential compromises of U.S. think tanks and defense industrial base entities. We encourage network owners to patch ASAP: https://t.co/Q2K4DYWQud

— Jake Sullivan (@JakeSullivan46) March 5, 2021

The vulnerability does not apply to Office 365 Exchange Online, only the on-premises versions of Microsoft’s email server platform. Attackers gaining access can execute code on the vulnerable servers, according to the U.S. Cybersecurity & Infrastructure Security Agency (CISA).

“Successful exploitation of these vulnerabilities allows an unauthenticated attacker to execute arbitrary code on vulnerable Exchange Servers, enabling the attacker to gain persistent system access, as well as access to files and mailboxes on the server and to credentials stored on that system,” a CISA alert revised on Saturday warned.

‘Anomalous Activity’

Network security monitoring service provider Volexity first detected “anomalous activity” on two of its customers’ Microsoft Exchange Servers in January. An investigation “revealed that the servers were not backdoored and uncovered a zero-day exploit being used in the wild,” Volexity reported on Tuesday.

Former Cybersecurity and Infrastructure Security agency director Chris Krebs (no relation to Brian Krebs) described the vulnerability as serious.

“This is the real deal,” he tweeted. Any organization that was running an unpatched version of Microsoft Exchange Server with OWA that was exposed to the internet between Feb. 26 and March 3, should assume they were compromised.

This is the real deal. If your organization runs an OWA server exposed to the internet, assume compromise between 02/26-03/03. Check for 8 character aspx files in C:\inetpubwwwrootaspnet_clientsystem_web. If you get a hit on that search, you’re now in incident response mode. https://t.co/865Q8cc1Rm

— Chris Krebs (@C_C_Krebs) March 5, 2021

“Check for 8 character aspx files in C:\\inetpub\wwwroot\aspnet_client\system_web\,” he advised. “If you get a hit on that search, you’re now in incident response mode.”

The warning applies to any organization whose 2013, 2016 or 2019 versions of Microsoft Exchange Server were exposed to the internet with Outlook Web Access (OWA). Potential victims include businesses across sectors, government agencies and higher education institutions.

Microsoft is also adding a “defense-in-depth” update to Exchange Server 2010, which reached the end of mainstream support in October. The company is urging customers running versions of Microsoft Exchange Server prior to 2013 to upgrade to a supported release.

As of midday Saturday, Microsoft senior threat intelligence analyst Kevin Beaumont tweeted: “A single server in the MailPot honeypot has been exploited with these vulnerabilities 5 times today, as a data point. So far nobody has actually done anything with those webshells, just planted them.”

A single server in the MailPot honeypot has been exploited with these vulnerabilities 5 times today, as a data point. So far nobody has actually done anything with those webshells, just planted them.

— Kevin Beaumont (@GossiTheDog) March 6, 2021