If you run Microsoft Exchange Server, it’s time to patch. A hacking group is exploiting previously unknown vulnerabilities to steal email files from US-based servers.
On Tuesday, Microsoft warned the public about the attacks, which it blamed on a Chinese state-sponsored group dubbed “Hafnium.”
The attacks, which remain ongoing, have been exploiting four vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019. As a result, Microsoft is urging corporate customers to install its patches as soon as possible. (Exchange Online is not affected, nor were any other Microsoft products.)
“In the attacks observed, the threat actor used these vulnerabilities to access on-premises Exchange servers, which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments,” the company wrote in a blog post.
The attacks began as early as Jan. 6, according to security firm Volexity, which helped uncover the hacking campaign. Volexity noticed the hackers were using the vulnerabilities to essentially loot the email files from Exchange servers from two Microsoft customers.
One of the vulnerabilities, CVE-2021-26855, is particularly serious because it can exploited remotely, without authentication of any kind. “The attacker only needs to know the server running Exchange and the account from which they want to extract e-mail,” Volexity wrote in a blog post.
Meanwhile, a second vulnerability can open the door to remote code execution, enabling an attacker to install malware on a Microsoft Exchange server.
According to Microsoft, Hafnium has been found stealing information from US targets, including “infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.” Interestingly, Microsoft says the Chinese state-sponsored group has been using virtual private servers in the US to help it pull off the attacks.
“Even though we’ve worked quickly to deploy an update for the Hafnium exploits, we know that many nation-state actors and criminal groups will move quickly to take advantage of any unpatched systems,” the company added. “Promptly applying today’s patches is the best protection against this attack.”
As a further precaution, Microsoft is releasing a patch for Microsoft Exchange Server 2010 to help mitigate the threat. Microsoft Defender, the company's free antivirus, has also been updated to detect Hafnium's malware tools.