https://www.channelfutures.com/wp-content/themes/channelfutures_child/assets/images/logo/footer-new-logo.png
  • Home
  • Technologies
    • Back
    • SDN/SD-WAN
    • Cloud
    • RMM/PSA
    • Security
    • Telephony/UC/Collaboration
    • Cable
    • Mobility & Wireless
    • Fiber/Ethernet
    • Data Centers
    • Backup & Disaster Recovery
    • IoT
    • Desktop
    • Artificial Intelligence
    • Analytics
  • Strategy
    • Back
    • Mergers and Acquisitions
    • Channel Research
    • Business Models
    • Distribution
    • Technology Solutions Brokerages
    • Sales & Marketing
    • Best Practices
    • Vertical Markets
    • Regulation & Compliance
  • MSP 501
    • Back
    • 2022 MSP 501 Rankings
    • 2022 NextGen 101 Rankings
  • Intelligence
    • Back
    • Galleries
    • Podcasts
    • From the Industry
    • Reports/Digital Issues
    • Webinars
    • White Papers
  • Channel Futures TV
  • EMEA
  • Channel Chatter
    • Back
    • People on the Move
    • New/Changing Channel Programs
    • New Products & Services
    • Industry Honors
  • Resources
    • Back
    • Advisory Boards
    • Industry Organizations
    • Our Sponsors
    • Advertise
    • 2022 Editorial Calendar
  • Awards
    • Back
    • 2022 MSP 501
    • Channel Influencers
    • Circle of Excellence
    • DE&I 101
    • Channel Partners 101 (CP 101)
  • Events
    • Back
    • CP Conference & Expo
    • MSP Summit
    • Channel Partners Europe
    • Channel Partners Event Coverage
    • Webinars
    • Industry Events
  • About Us
  • DE&I
Channel Futures
  • NEWSLETTER
  • Home
  • Technologies
    • Back
    • SDN/SD-WAN
    • Cloud
    • RMM/PSA
    • Security
    • Telephony/UC/Collaboration
    • Cable
    • Mobility & Wireless
    • Fiber/Ethernet
    • Data Centers
    • Backup & Disaster Recovery
    • IoT
    • Desktop
    • Artificial Intelligence
    • Analytics
  • Strategy
    • Back
    • Mergers and Acquisitions
    • Channel Research
    • Business Models
    • Distribution
    • Technology Solutions Brokerages
    • Sales & Marketing
    • Best Practices
    • Vertical Markets
    • Regulation & Compliance
  • MSP 501
    • Back
    • 2022 MSP 501 Rankings
    • 2022 NextGen 101 Rankings
  • Intelligence
    • Back
    • Galleries
    • Podcasts
    • From the Industry
    • Reports/Digital Issues
    • Webinars
    • White Papers
  • Channel Futures TV
  • EMEA
  • Channel Chatter
    • Back
    • People on the Move
    • New/Changing Channel Programs
    • New Products & Services
    • Industry Honors
  • Resources
    • Back
    • Advisory Boards
    • Industry Organizations
    • Our Sponsors
    • Advertise
    • 2022 Editorial Calendar
  • Awards
    • Back
    • 2022 MSP 501
    • Channel Influencers
    • Circle of Excellence
    • DE&I 101
    • Channel Partners 101 (CP 101)
  • Events
    • Back
    • CP Conference & Expo
    • MSP Summit
    • Channel Partners Europe
    • Channel Partners Event Coverage
    • Webinars
    • Industry Events
  • About Us
  • DE&I
    • Newsletter
  • REGISTER
  • MSPs
  • VARs / SIs
  • Agents
  • Cloud Service Providers
  • Channel Partners Events
 Channel Futures

Security


Shutterstock

Hacker looking at computer

Microsoft Exchange Server Zero-Day Exploit Could Have Thousands of Victims

  • Written by Jeffrey Schwartz
  • March 6, 2021
Customers and service providers were urged to apply new patch immediately.

Chinese hackers have infiltrated hundreds of thousands of on-premises Microsoft Exchange Server instances throughout the world, according to multiple reports. Microsoft, which identified the attackers as Hafnium, is urging organizations running the email server to install newly released patches.

Hafnium is a nation-state actor, warned Tom Burt, Microsoft’s corporate VP for customer security and trust. The group has penetrated more than 30,000 organizations in the U.S., Brian Krebs of the respected KrebsOnSecurity site reported Friday night.

Krebs said the hackers may have breached hundreds of thousands of Microsoft Exchange Servers throughout the world. Krebs cited two anonymous sources who briefed U.S. security advisors.

A Wired report on Saturday confirmed Krebs findings. The impact of the Microsoft Exchange Server vulnerability could be “absolutely massive,” an informed former national security advisor told Wired. “We’re talking thousands of servers compromised per hour, globally.”

If the predicted number of victims are indeed that many, it could impact more organizations than the SolarWinds attack. That massive attack by Russian hackers, revealed in December, may have impacted as many as 18,000 organizations.

White House Concerned

White House press secretary Jen Psaki addressed the issue in Friday’s daily briefing, describing the vulnerabilities as significant.

“We’re concerned that there are a large number of victims,” Psaki said.

Since Microsoft revealed the zero-day exploit days earlier, Hafnium has “stepped up” its attacks on unpatched Exchange Servers, Krebs noted.  Consequently, they may have “seized control over hundreds of thousands of Microsoft Exchange Servers worldwide,” he added.

Jake Sullivan, President Joe Biden’s National Security Advisor, echoed Microsoft’s call for organizations to patch their Microsoft Exchange Server instances.

“We are closely tracking Microsoft’s emergency patch for previously unknown vulnerabilities in Exchange Server software and reports of potential compromises of U.S. think tanks and defense industrial base entities,” Sullivan tweeted. “We encourage network owners to patch ASAP.”

We are closely tracking Microsoft’s emergency patch for previously unknown vulnerabilities in Exchange Server software and reports of potential compromises of U.S. think tanks and defense industrial base entities. We encourage network owners to patch ASAP: https://t.co/Q2K4DYWQud

— Jake Sullivan (@JakeSullivan46) March 5, 2021

The vulnerability does not apply to Office 365 Exchange Online, only the on-premises versions of Microsoft’s email server platform. Attackers gaining access can execute code on the vulnerable servers, according to the U.S. Cybersecurity & Infrastructure Security Agency (CISA).

“Successful exploitation of these vulnerabilities allows an unauthenticated attacker to execute arbitrary code on vulnerable Exchange Servers, enabling the attacker to gain persistent system access, as well as access to files and mailboxes on the server and to credentials stored on that system,” a CISA alert revised on Saturday warned.

‘Anomalous Activity’

Network security monitoring service provider Volexity first detected “anomalous activity” on two of its customers’ Microsoft Exchange Servers in January. An investigation “revealed that the servers were not backdoored and uncovered a zero-day exploit being used in the wild,” Volexity reported on Tuesday.

Former Cybersecurity and Infrastructure Security agency director Chris Krebs (no relation to Brian Krebs) described the vulnerability as serious.

“This is the real deal,” he tweeted. Any organization that was running an unpatched version of Microsoft Exchange Server with OWA that was exposed to the internet between Feb. 26 and March 3, should assume they were compromised.

This is the real deal. If your organization runs an OWA server exposed to the internet, assume compromise between 02/26-03/03. Check for 8 character aspx files in C:\inetpubwwwrootaspnet_clientsystem_web. If you get a hit on that search, you’re now in incident response mode. https://t.co/865Q8cc1Rm

— Chris Krebs (@C_C_Krebs) March 5, 2021

“Check for 8 character aspx files in C:\\inetpub\wwwroot\aspnet_client\system_web\,” he advised. “If you get a hit on that search, you’re now in incident response mode.”

The warning applies to any organization whose 2013, 2016 or 2019 versions of Microsoft Exchange Server were exposed to the internet with Outlook Web Access (OWA). Potential victims include businesses across sectors, government agencies and higher education institutions.

Microsoft is also adding a “defense-in-depth” update to Exchange Server 2010, which reached the end of mainstream support in October. The company is urging customers running versions of Microsoft Exchange Server prior to 2013 to upgrade to a supported release.

As of midday Saturday, Microsoft senior threat intelligence analyst Kevin Beaumont tweeted: “A single server in the MailPot honeypot has been exploited with these vulnerabilities 5 times today, as a data point. So far nobody has actually done anything with those webshells, just planted them.”

A single server in the MailPot honeypot has been exploited with these vulnerabilities 5 times today, as a data point. So far nobody has actually done anything with those webshells, just planted them.

— Kevin Beaumont (@GossiTheDog) March 6, 2021

Tags: MSPs VARs/SIs Security Specialty Practices Technologies

Most Recent


  • Cyber insurance
    Now Is the Time to Consider Cyber Insurance for Your Business
    If your business is online and accesses sensitive data, the need for cyber insurance is becoming critical.
  • Making Waves
    7 Channel People Making Waves This Week at Kaseya, AT&T, Cohesity, More
    Cloud-managed service is the fastest-growing area one analyst said in response to an MSP acquisition this week.
  • Job cuts
    RingCentral Announced Layoffs Ahead of Strong Earnings Growth in Q2
    RingCentral says changing business needs necessitate the job cuts.
  • Microsoft Adds Threat Intelligence, Proactive Hunting to Defender
    The new Microsoft Defender offerings come as the company encourages partners to offer more security.

Leave a comment Cancel reply

-or-

Log in with your Channel Futures account

Alternatively, post a comment by completing the form below:

Your email address will not be published. Required fields are marked *

Related Content

  • Data Center Hacker, dark data
    How SolarWinds' Massive Hack Upended Cybersecurity
  • Class Action Lawsuit
    Massive SolarWinds Hack Leads to Class-Action Lawsuit
  • Billing
    Massive SolarWinds Hack Prompts Up to $25 Million in New Security Costs for Company
  • Word conclusion on paper
    Microsoft Conclusion on SolarWinds Hack 'Conflicts' with Other Messages

Upcoming Events

View all

MSP Summit

September 13, 2022 - September 16, 2022

Channel Partners Conference & Expo

May 1, 2023 - May 4, 2023

Galleries

View all

Images: Telarus Hosts Partner Summit, Gives Partner, Supplier Awards

August 5, 2022

7 Channel People Making Waves This Week at Kaseya, AT&T, Cohesity, More

August 5, 2022

The Gately Report: Zscaler Tracks New, Increasingly Dangerous Ransomware Group, Most Targeted Types of People

August 5, 2022

Industry Perspectives

View all

Seize the Application Modernization Opportunity

August 2, 2022

A Growth Mindset: Your Organization’s Strategic Differentiator

August 1, 2022

Timely Tips for Non-Negotiable Patch Updates

July 29, 2022

Webinars

View all

Outsmarting RaaS: Implementation Strategies To Help Your Clients Before, During, and After a Ransomware Attack

August 23, 2022

Why it is Important to Upgrade Aging Servers and How to use Live Optics to Upgrade Efficiently

August 25, 2022

Executives at Home are Not Alright: An Intro to Digital Executive Protection

September 8, 2022

White Papers

View all

Work Goes Remote – (and Other Top ITOps Trends)

May 25, 2022

The New Bottom Line: How MSPs Can Meet the Healthcare Crisis While Evolving Their Businesses

April 19, 2022

How to build a Security Operations Center (on a budget)

April 4, 2022

Channel Futures TV

View all

Vonage a ‘Single Communications Stack Provider’ for Partners, Customers

IBM, Partners and the $1 Trillion Hybrid Cloud Opportunity

June 26, 2022

Agents Share ‘Secrets,’ Industry Opportunity

May 11, 2022

AT&T, Microsoft, Cisco, ThreatLocker on Unlocking Partner Potential

May 6, 2022

Twitter

ChannelFutures

.@ConnectWise says use #cyberinsurance policies to protect from worst of cyberattack repercussions, but first beef… twitter.com/i/web/status/1…

August 8, 2022
ChannelFutures

Check out our pictures from the #TelarusPartnerSummit that @telarus hosted in Salt Lake City.… twitter.com/i/web/status/1…

August 5, 2022
ChannelFutures

Channel People Making Waves This Week Include: @spoonen, @RoyArsan, @TheAnneChow, @AnuragTechaisle… twitter.com/i/web/status/1…

August 5, 2022
ChannelFutures

.@RingCentral plans #layoffs after strong Q2 earnings. dlvr.it/SW7kd5 https://t.co/OIlLuYgyLJ

August 5, 2022
ChannelFutures

.@msftsecurity makes upgrades to #MicrosoftDefender. dlvr.it/SW7cpg https://t.co/KbPsyM8eYe

August 5, 2022
ChannelFutures

.@ZeroFox goes public after #SPAC merger. #cybersecurity dlvr.it/SW7NjC https://t.co/IhaO9vgDh7

August 5, 2022
ChannelFutures

.@Mitel's new developer portal, and integration into CloudLink, creates a "vibrant" communications developer commun… twitter.com/i/web/status/1…

August 5, 2022
ChannelFutures

Boost security, secure #SoftwareSupplyChain in light of #Log4Shell breach, says @synopsys. dlvr.it/SW7GbT https://t.co/NlKeEFUlMS

August 5, 2022

MSP 501

The industry's largest and most comprehensive partner awards program.

Newsletters and Updates

Sign up for The Channel Report, Channel Futures Update, MSP 501 Newsletter and more.

Live Channel Events

Get the latest information on the next industry-leading Channel Partners event.

Galleries

Educational slide shows and images from live events.

Media Kit And Advertising

Want to reach our audience? Access our media kit.

DISCOVER MORE FROM INFORMA TECH

  • Channel Partners Events
  • Telecoms.com
  • MSP 501
  • Black Hat
  • IoT World Today
  • Omdia

WORKING WITH US

  • Contact
  • About Us
  • Advertise
  • Newsletter

FOLLOW Channel Futures ON SOCIAL

  • Privacy
  • CCPA: “Do Not Sell My Data”
  • Cookie Policy
  • Terms
Copyright © 2022 Informa PLC. Informa PLC is registered in England and Wales with company number 8860726 whose registered and Head office is 5 Howick Place, London, SW1P 1WG.
This website uses cookies, including third party ones, to allow for analysis of how people use our website in order to improve your experience and our services. By continuing to use our website, you agree to the use of such cookies. Click here for more information on our Cookie Policy and Privacy Policy.
X