Facing multiple hacking attempts on its business email servers worldwide, Microsoft has reiterated the warning that patching a system does not necessarily remove the access of the attacker.
The key vulnerabilities in the Microsoft business email servers have left cyber security experts flummoxed as this free-for-all attack opportunity is now being exploited by vast numbers of criminal gangs, state-backed threat actors and opportunistic “script kiddies,” researchers at F-Secure said last week.
Although many on-premises Microsoft Exchange servers have been patched, New investigation has found that multiple threats are still lurking on already-compromised systems.
According to Microsoft 365 Defender Threat Intelligence Team, many of the compromised systems have not yet received a secondary action, “such as human-operated ransomware attacks or data exfiltration, indicating attackers could be establishing and keeping their access for potential later actions”.
“These actions might involve performing follow-on attacks via persistence on Exchange servers they have already compromised, or using credentials and data stolen during these attacks to compromise networks through other entry vectors,” the tech giant said in its latest update.
Taiwanese electronics and computer maker Acer has already been hit by a ransomware attack where the hackers are demanding $50 million, the largest known ransom to date.
According to Bleeping Computer, hackers have accessed Acer documents that include financial spreadsheets, bank balances and bank communications, compromising its network via a Microsoft Exchange server vulnerability.
Earlier reports have claimed that five different hacking groups (including China-backed hacking group called ‘Hafnium’) are exploiting vulnerabilities in the business email servers of Microsoft.
According to Microsoft, attackers who included the exploit in their toolkits, whether through modifying public proof of concept exploits or their own research, capitalized on their window of opportunity to gain access to as many systems as they could.
“Some attackers were advanced enough to remove other attackers from the systems and use multiple persistence points to maintain access to a network,” the company noted.
Microsoft said that it is important to note that with “some post-compromise techniques, attackers may gain highly privileged persistent access, but many of the impactful subsequent attacker activities can be mitigated by practicing the principle of least privilege and mitigating lateral movement”.
According to the F-Secure report, countries currently seeing the most detections (in descending order) are Italy, Germany, France, the UK, the US, Belgium, Kuwait, Sweden, the Netherlands and Taiwan.
