In the latest in a string of security-related headaches for Microsoft, the company warned customers Tuesday that state sponsored hackers from China have been exploiting flaws in one of its widely used email products, Exchange, in order to target American companies for data theft.
In several recently published blog posts, the company listed four newly discovered zero-day vulnerabilities associated with the attacks, as well as patches and a list of compromise indicators. Users of Exchange have been urged to update to avoid getting hacked.
Microsoft researchers have dubbed the main hacker group behind the attacks “HAFNIUM,” describing it as a “highly skilled and sophisticated actor” focused on conducting espionage via data theft. In past campaigns, HAFNIUM has been known to target a wide variety of entities throughout the U.S., including “infectious disease researchers, law firms, higher education institutions, defence contractors, policy think tanks and NGOs,” they said.
[referenced id=”1661448″ url=”https://gizmodo.com.au/2021/01/microsoft-says-solarwinds-hackers-also-broke-into-its-source-code/” thumb=”https://gizmodo.com.au/wp-content/uploads/2021/01/01/rpqzj6kmtr5jfdffxnjk-300×169.jpg” title=”Microsoft Says SolarWinds Hackers Also Broke Into Its Source Code” excerpt=”The hackers behind the massive SolarWinds cyberattack, an operation allegedly backed by Russia that compromised networks at many U.S. agencies and Fortune 500 corporations, also broke into Microsoft’s internal systems and accessed the company’s most closely guarded secret: its source code.”]
In the case of Exchange, these attacks have meant data exfiltration from email accounts. Exchange works with mail clients like Microsoft Office, synchronizing updates to devices and computers, and is widely used by companies, universities, and other large organisations.
Attacks on the product have unfolded like this: hackers will leverage zero days to gain entry to an Exchange server (they also sometimes used compromised credentials). They then typically will deploy a web shell (a malicious script), hijacking the server remotely. Hackers can then steal data from an associated network, including whole tranches of emails. The attacks were conducted from U.S.-based private servers, according to Microsoft.
Microsoft Corporate Vice President of Customer Security Tom Burt said Tuesday that customers should work quickly to update associated security flaws:
Even though we’ve worked quickly to deploy an update for the Hafnium exploits, we know that many nation-state actors and criminal groups will move quickly to take advantage of any unpatched systems. Promptly applying today’s patches is the best protection against this attack.
[referenced id=”1662298″ url=”https://gizmodo.com.au/2021/01/solarwinds-hackers-accessed-more-than-3000-doj-email-accounts/” thumb=”https://gizmodo.com.au/wp-content/uploads/2021/01/07/egy8hpfgurucr3yibz9m-300×169.jpg” title=”SolarWinds Hackers Accessed More Than 3,000 DOJ Email Accounts” excerpt=”In yet another dastardly twist in the ongoing SolarWinds debacle, the U.S. Department of Justice announced Wednesday that hackers had accessed the inboxes of over 3,000 DOJ employee Microsoft email accounts.”]
The situation was originally brought to Microsoft’s attention by researchers at two different security firms, Volexity and Dubex. According to KrebsOnSecurity, Volexity initially found evidence of the intrusion campaigns on Jan. 6. In a blog post Tuesday, Volexity researchers helped break down what the malicious activity looked like in one particular case:
Through its analysis of system memory, Volexity determined the attacker was exploiting a zero-day server-side request forgery (SSRF) vulnerability in Microsoft Exchange (CVE-2021-26855). The attacker was using the vulnerability to steal the full contents of several user mailboxes. This vulnerability is remotely exploitable and does not require authentication of any kind, nor does it require any special knowledge or access to a target environment. The attacker only needs to know the server running Exchange and what account from which they want to extract email.
These recent hacking campaigns — which Microsoft has said are “limited and targeted” in nature — are unassociated with the ongoing “SolarWinds” attacks that the tech giant is also currently embroiled in. The company hasn’t said how many organisations were targeted or successfully compromised by the campaign, though other threat actors besides HAFNIUM may also be involved. Microsoft says it has briefed federal authorities on the incidents.