Microsoft Exchange servers targeted by 'at least ten hacker groups'

ESET research found that hackers managed to install backdoors on more than 5,000 servers in over 115 countries

No less than 10 advanced persistent threat (APT) groups are taking advantage of the four zero-day vulnerabilities found in Microsoft Exchange.

This is despite previous reports from Microsoft which identified state-backed hacker group Hafnium as the only one behind last week’s attacks, which exploited flaws labelled as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065.

However, research by Bratislava-based internet security company ESET has found that there are multiple other threat groups and behaviour clusters benefitting from the flaws, having so far identified APT groups such as the Winnti group, Tick, LuckyMouse, Calypso, Websiic, Tonto Team, the “Opera” Cobalt Strike, Mikroceen, DLTMiner, as well as ShadowPad activity conducted by an unknown group and IIS backdoors, which includes Owlproxy.

The Winnti group, which has been active since 2012, had mostly been focused on the online gaming industry until its involvement in last year’s attempts to steal intellectual property from Linux servers. In the past, it has also targeted developers, Chinese journalists, the Taiwanese government, and tech organisations.

Malware researcher Matthieu Faou, who is heading ESET’s research effort into the Exchange vulnerability chain, said that on 4 March ESET researchers “started to observe many more threat actors scanning and compromising Exchange servers en masse”.

“Interestingly, all of them are APT groups focused on espionage, except one outlier that seems related to a known coin-mining campaign. However, it is inevitable that more and more threat actors, including ransomware operators, will have access to the exploits sooner or later. This means we can discard the possibility that those groups built an exploit by reverse engineering Microsoft updates,” he added.

ESET also found that the web shell backdoors, which allow remote control of a server via a web browser, had been installed by the hackers on more than 5,000 unique servers in over 115 countries.

Exchange servers in the UK were some of the 650 hit by the “Opera” Cobalt Strike, which also targeted organisations in the US, Germany, and other European countries just a few hours after the patches were released.

According to Faou, “it is now clearly beyond prime time to patch all Exchange servers as soon as possible”.

“Even those not directly exposed to the internet should be patched. In case of compromise, admins should remove the webshells, change credentials and investigate for any additional malicious activity. The incident is a very good reminder that complex applications such as Microsoft Exchange or SharePoint should not be open to the internet,” he advised.

Microsoft was not immediately available for comment.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Russia's "politically motivated" REvil raid could be used as leverage, experts warn
ransomware

Russia's "politically motivated" REvil raid could be used as leverage, experts warn

17 Jan 2022
Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp
phishing

Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp

21 Dec 2021
Five things to consider before choosing an MFA solution
Security

Five things to consider before choosing an MFA solution

17 Dec 2021
Australia and US sign CLOUD Act data-sharing deal to support criminal investigations
cyber crime

Australia and US sign CLOUD Act data-sharing deal to support criminal investigations

16 Dec 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022