Microsoft Exchange Server attacks: What we know so far

The vulnerabilities

There are four vulnerabilities related to the Exchange Server attacks, the most serious of which is CVE-2021-26855. Also known as "ProxyLogon," this zero-day is a server-side request forgery (SSRF) vulnerability. ProxyLogon was discovered in December 2020 by an anonymous threat researcher at Devcore, an infosec consulting firm in Taiwan.

Later in December, Devcore discovered a second Exchange Server vulnerability, CVE-2021-27065, which is a post-authentication arbitrary file write bug. Devcore found that chaining this vulnerability with ProxyLogon produced a remote code execution (RCE) exploit, and they reported both bugs to Microsoft on Jan. 5. Microsoft confirmed receipt of the report the following day and informed Devcore on Jan. 8 that it had replicated the behavior of the vulnerabilities and the chained exploit.

During the course of the investigation into ProxyLogon, Microsoft received reports of threat activity from Volexity, an incident response vendor headquartered in Washington, D.C., and Dubex, an infosec consultancy based in Denmark. The threats involved anomalous network activity from customers' Microsoft Exchange servers that included exploitation of ProxyLogon. As a result, researchers at the Microsoft Threat Intelligence Center discovered two additional vulnerabilities in Exchange Server that were being exploited by attackers: CVE-2021-26857, an  insecure deserialization vulnerability in the software's Unified Messaging service; and CVE-2021-26858, a second post-authentication arbitrary file write vulnerability.

Microsoft has originally planned to patch these Exchange Server vulnerabilities on March 9 for the company's regular Patch Tuesday updates. However, the company moved up the patches and disclosure to March 2. In the wake of the disclosure, exploitation of the flaws increased significantly, according to various reports.

The attackers

Microsoft attributed the initial ProxyLogon attacks to the Chinese state-sponsored threat group known as Hafnium. According to Microsoft's blog post, Hafnium operators exploited the vulnerabilities to gain initial access then deployed web shells on the compromised server. "Web shells potentially allow attackers to steal data and perform additional malicious actions that to further compromise," the blog post said.

In an update Friday, Microsoft said it "continues to see increased use of vulnerabilities in attacks targeting unpatched systems by multiple malicious actors beyond HAFNIUM." It's unclear who the additional threat actors are, and what their motivations may be. However, threat detection vendor Red Canary reported exploitation activity that involved the installation of a cryptomining program called Dltminer.

Volexity provided an update to a blog post from March 2 where it dated the first attacks to January of this year. The update revealed an even earlier timeline than initially reported.

"Since the original publication of this blog, Volexity has no observed that cyber espionage operations using the SSRF vulnerability CVE-2021-26855 started occurring on January 3, 2021, three days earlier than initially posted," the statement said.

The victims

Several news outlets reported the Exchange Server attacks have impacted 20,000 to 30,000 organizations in the U.S. alone. However, several infosec experts, including former CISA director Christopher Krebs, believe the number is much higher. CISA meanwhile said on Saturday it was aware of "widespread domestic and international exploitation" of the vulnerabilities.

While the number of potential victims has reportedly increased since last week, the list of data breach disclosures has not. So far, the European Banking Authority appears to be the only company that has confirmed a breach. In a statement Sunday, it attributed a cyber attack to its Microsoft Exchange Servers.

"The European Banking Authority (EBA) has been the subject of a cyber-attack against its Microsoft Exchange Servers, which is affecting many organizations worldwide. The Agency has swiftly launched a full investigation, in close cooperation with its ICT provider, a team of forensic experts and other relevant entities," the statement said.

In an update Monday, EBA said they do not believe any data was extracted, and they have no indication that the breach has gone beyond the email servers. However, the bank did take email systems offline as a precautionary measure.

As it turns out, those precautionary measures were successful. In a third update Tuesday, EBA said email services had been restored.

"The European Banking Authority has established the scope of the event caused by the recently widely notified vulnerabilities was limited and that the confidentiality of the EBA systems and data has not been compromised. Thanks to the precautionary measures taken, the EBA has managed to remove the existing threat and its email communication services have, therefore, been restored."

Reports by cybersecurity firms FireEye and Huntress Labs say the range of victims is wide.

"We've also witnessed many city and county government victims, healthcare providers, banks/financial institutions, and several residential electricity providers," the blog post said.

Additionally, Huntress has been tracking the number of unpatched systems on Exchange servers. As of Friday, around 800 remained unpatched and "without the hotfix for an up-to-date CU version number."

According to a FireEye Mandiant blog, victims include U.S.-based retailers, local governments, a university and an engineering firm. "Related activity may also include a Southeast Asian government and Central Asian telecom," the blog post said.