URGENT — 4 Actively Exploited 0-Day Flaws Found in Microsoft Exchange

Microsoft has released emergency patches^[1] to address four
previously undisclosed security flaws in Exchange Server that it
says are being actively exploited by a new Chinese state-sponsored
threat actor with the goal of perpetrating data theft.

Describing the attacks as “limited and targeted,” Microsoft
Threat Intelligence Center (MSTIC) said the threat actor used these
vulnerabilities to access on-premises Exchange servers, in turn
granting access to email accounts and paving the way for the
installation of additional malware to facilitate long-term access
to victim environments.

The tech giant primarily attributed the campaign with high
confidence to a threat actor it calls HAFNIUM, a state-sponsored
hacker collective operating out of China, although it suspects
other groups may also be involved.

Discussing the tactics, techniques, and procedures (TTPs) of the
group for the first time, Microsoft paints HAFNIUM as a “highly
skilled and sophisticated actor” that mainly singles out entities
in the U.S. for exfiltrating sensitive information from an array of
industry sectors, including infectious disease researchers, law
firms, higher education institutions, defense contractors, policy
think tanks and NGOs.

HAFNIUM is believed to orchestrate its attacks by leveraging
leased virtual private servers in the U.S. in an attempt to cloak
its malicious activity.

The three-stage attack involves gaining access to an Exchange
Server either with stolen passwords or by using previously
undiscovered vulnerabilities, followed by deploying a web shell to
control the compromised server remotely. The last link in the
attack chain makes use of remote access to plunder mailboxes from
an organization’s network and export the collected data to file
sharing sites like MEGA.

To achieve this, as many as four zero-day vulnerabilities^[2] discovered by
researchers from Volexity and Dubex are used as part of the attack
chain —

• CVE-2021-26855^[3]: A server-side request
  forgery (SSRF) vulnerability in Exchange Server
• CVE-2021-26857^[4]: An insecure
  deserialization vulnerability in the Unified Messaging service
• CVE-2021-26858^[5]: A post-authentication
  arbitrary file write vulnerability in Exchange, and
• CVE-2021-27065^[6]: A post-authentication
  arbitrary file write vulnerability in Exchange

Although the vulnerabilities impact Microsoft Exchange Server
2013, Microsoft Exchange Server 2016, and Microsoft Exchange Server
2019, Microsoft said it’s updating Exchange Server 2010 for
“Defense in Depth” purposes.

Furthermore, since the initial attack requires an untrusted
connection to Exchange server port 443, the company notes that
organizations can mitigate the issue by restricting untrusted
connections or by using a VPN to separate the Exchange server from
external access.

Microsoft, besides stressing that the exploits were not
connected to the SolarWinds-related breaches, said it has briefed
appropriate U.S. government agencies about the new wave of attacks.
But the company didn’t elaborate on how many organizations were
targeted and whether the attacks were successful.

Stating that the intrusion campaigns appeared to have started
around January 6, 2021, Volexity cautioned its detected active
in-the-wild exploitation of multiple Microsoft Exchange
vulnerabilities used to steal email and compromise networks.

“While the attackers appear to have initially flown largely
under the radar by simply stealing emails, they recently pivoted to
launching exploits to gain a foothold,” Volexity researchers Josh
Grunzweig, Matthew Meltzer, Sean Koessel, Steven Adair, and Thomas
Lancaster explained^[7]
in a write-up.

“From Volexity’s perspective, this exploitation appears to
involve multiple operators using a wide variety of tools and
methods for dumping credentials, moving laterally, and further
backdooring systems.”

Microsoft Senior Threat Intelligence Analyst Kevin Beaumont has
also created^[8]
a nmap plugin^[9]
that can be used to scan a network for potentially vulnerable
Microsoft Exchange servers.

“Even though we’ve worked quickly to deploy an update for the
Hafnium exploits, we know that many nation-state actors and
criminal groups will move quickly to take advantage of any
unpatched systems,” Microsoft’s Corporate Vice President of
Customer Security, Tom Burt, said^[10]. “Promptly applying
today’s patches is the best protection against this attack.”

Given the severity of the flaws, it’s no surprise that patches
have been rolled out a week ahead of the company’s Patch Tuesday
schedule, which is typically reserved for the second Tuesday of
each month. Customers using a vulnerable version of Exchange Server
are recommended to install the updates immediately to thwart these
attacks.