CISA Issues Emergency Directive on In-the-Wild Microsoft Exchange Flaws

Following Microsoft’s release of out-of-band patches to address
multiple zero-day flaws in on-premises versions of Microsoft
Exchange Server, the U.S. Cybersecurity and Infrastructure Security
Agency (CISA) has issued^[1]
an emergency directive warning of “active exploitation^[2]” of the
vulnerabilities.

The alert comes on the heels of Microsoft’s disclosure^[3]
that China-based hackers were exploiting unknown software bugs in
Exchange server to steal sensitive data from select targets,
marking the second time in four months^[4] that the U.S. has
scrambled to address a widespread hacking campaign believed to be
the work of foreign threat actors.

While the company mainly attributed the campaign to a threat
group called HAFNIUM, Slovakian cybersecurity firm ESET said^[5]
it found evidence of CVE-2021-26855 being actively exploited in the
wild by several cyber espionage groups, including LuckyMouse, Tick,
and Calypso targeting servers located in the U.S., Europe, Asia,
and the Middle East.

Researchers at Huntress Labs have also sounded the alarm about
mass exploitation of Exchange servers, noting that over 350 web
shells have been discovered across approximately 2,000 vulnerable
servers.

“Among the vulnerable servers, we also found over 350 web shells
— some targets may have more than one web shell, potentially
indicating automated deployment or multiple uncoordinated actors,”
Huntress senior security researcher John Hammond said^[6]. “These endpoints do
have antivirus or EDR solutions installed, but this has seemingly
slipped past a majority of preventative security products.”

The latest development indicates a much larger spread that
extends beyond the “limited and targeted” attack reported by
Microsoft earlier this week.

It’s not clear if any U.S. government agencies have been
breached in the campaign, but the CISA directive underscores the
urgency of the threat.

Strongly urging organizations to apply the patches as soon as
possible, the agency cited the “likelihood of widespread
exploitation of the vulnerabilities after public disclosure and the
risk that federal government services to the American public could
be degraded.”