Microsoft Urges Customers to Secure On-Premises Exchange Servers

Jan 28, 2023Ravie LakshmananEmail Security / Cyber Threat

Microsoft is urging customers to keep their Exchange servers
updated as well as take steps to bolster the environment, such as
enabling Windows Extended Protection^[1] and configuring certificate-based signing^[2] of PowerShell
serialization payloads.

“Attackers looking to exploit unpatched Exchange servers are not
going to go away,” the tech giant’s Exchange Team said^[3]
in a post. “There are too many aspects of unpatched on-premises
Exchange environments that are valuable to bad actors looking to
exfiltrate data or commit other malicious acts.”

Microsoft also emphasized mitigations issued by the company are
only a stopgap solution and that they can “become insufficient to
protect against all variations of an attack,” necessitating that
users install necessary security updates to secure the servers.

Exchange Server has been proven to be a lucrative attack vector^[4]
in recent years, what with a number of security flaws in the
software weaponized as zero-days to hack into systems.

In the past two years alone, several sets of vulnerabilities
have been discovered in Exchange Server – including ProxyLogon^[5], ProxyOracle^[6], ProxyShell^[7], ProxyToken^[8], ProxyNotShell^[9], and a ProxyNotShell
mitigation bypass known as OWASSRF^[10] – some of which have
come under widespread exploitation in the wild.

Bitdefender, in a technical advisory published this week,
described Exchange as an “ideal target,” while also chronicling
some of the real-world attacks involving the ProxyNotShell /
OWASSRF exploit chains since late November 2022.

“There is a complex network^[11] of frontend and backend
services [in Exchange], with legacy code to provide backward
compatibility,” Bitdefender’s Martin Zugec noted^[12]. “Backend services
trust the requests from the front-end [Client Access Services] layer.”

Another reason is the fact that multiple backend services run as
Exchange Server itself, which comes with SYSTEM privileges, and
that the exploits could grant the attacker malicious access to the
remote PowerShell^[13] service, effectively
paving the way for the execution of malicious commands.

To that end, attacks weaponizing the ProxyNotShell and OWASSRF
flaws have targeted arts and entertainment, consulting, law,
manufacturing, real estate, and wholesale industries located in
Austria, Kuwait, Poland, Turkey, and the U.S.

“These types of server-side request forgery (SSRF^[14]) attacks allow an
adversary to send a crafted request from a vulnerable server to
other servers to access resources or information that are otherwise
not directly accessible,” the Romanian cybersecurity company
said.

Most of the attacks are said to be opportunistic rather than
focused and targeted, with the infections culminating in the
attempted deployment of web shells and remote monitoring and
management (RMM) software such as ConnectWise Control and GoTo
Resolve.

Web shells not only offer a persistent remote access mechanism,
but also allow the criminal actors to conduct a wide range of
follow-on activities and even sell the access to other hacker
groups for profit.

In some cases, the staging servers used to host the payloads
were compromised by Microsoft Exchange servers themselves,
suggesting that the same technique may have been applied to expand
the scale of the attacks.

Also observed were unsuccessful efforts undertaken by
adversaries to download Cobalt Strike as well as a Go-based implant
codenamed GoBackClient that comes with capabilities to gather
system information and spawn reverse shells.

The abuse of Microsoft Exchange vulnerabilities has also been a
recurring tactic employed by UNC2596^[15] (aka Tropical
Scorpius), the operators of Cuba^[16] (aka COLDDRAW)
ransomware, with one attack leveraging the ProxyNotShell exploit
sequence to drop the BUGHATCH^[17] downloader.

“While the initial infection vector keeps evolving and threat
actors are quick to exploit any new opportunity, their
post-exploitation activities are familiar,” Zugec said. “The best
protection against modern cyber-attacks is a defense-in-depth
architecture.”