March 29, 2021

Zero-Day vulnerabilities in Microsoft Exchange and their serious effects we do not know yet

MS Exchange gaps still threaten companies, public benefit organizations and many institutions. Although more than 90% of servers have been patched and vulnerabilities removed, the problem is that it is not known how many systems were already attacked before the vulnerability was removed.

Appropriate scripts and guides from Microsoft come to the rescue here, which describe the vulnerability and their removal, allow more or less probability to determine whether potential attackers accidentally exploited the vulnerability in our environments and what further steps should be taken – you can read it here HAFNIUM targeting Exchange Servers with 0-day exploits.

In one of the worst scenarios, after gaining access to the Exchange server, which was not difficult to exploit the vulnerability, attackers gain access to mailboxes, calendar, tasks, and contacts. Based on the obtained permissions, it starts further penetrating the company’s resources while hiding his presence. Therefore, there is a very high risk here related to the loss of confidentiality of information, leakage or destruction of data or blocking access to them and the entire infrastructure. It is also not difficult to imagine a different scenario in which – having access to the Exchange server – the attacker will impersonate a given company or person in the organization and spread his malicious activities, e.g. through phishing and harm our contractors and business partners.
It is significant that, apart from the confirmed many cases of exploiting the vulnerability in the server, we have not yet heard about any further actions of criminal groups.

However, more and more facts suggest that using this vulnerability allowed the REvil hackers group to launch a ransomware attack on Acer, which has been quite loud lately: REvil ransomware attack on Acer the most expensive in history.

This may suggest that in the future, criminals will want to sell the access for a targeted attack or to further surveillance and control a given organization for later monetization of hackers activities.
NaviRisk offer services for securing infrastructure elements and monitoring and managing vulnerabilities in the company’s ICT resources.

Read more:

CyberPrevent Solutions – Managed Security Service Provider (MSSP)

To stay ahead of cyberattacks’ dangers, we have developed CyberPrevent Solutions – fully managed security services. We will provide your company with 24-hour technical support to protect against cyber threats, and you will be able to take care of what is essential, namely running your business. Security is a 24/7 task, but it does not […]

Incident Response 24/7, SOCS, IR, SOARS

First of all, we help companies prepare for an incident. We react to eliminate the effects of an undesirable event. As part of proactive services related to incident management, we offer: modelling and implementation as well as auditing technological and organisational solutions as part of incident management; assessment of the maturity of teams within the […]

Vulnerability management

One of the elements of maintaining an appropriate cybersecurity level is detecting and removing vulnerabilities in the ICT infrastructure. These are continuous, cyclical and random processes, e.g., introducing a new service, a new application or changes. Our services cover the entire vulnerability management process cycle, i.e. resource identification and prioritisation, vulnerability detection, and weighting. The […]

CONTACT

NaviRisk Sp. z o.o.

ul. Huculska 5/6
00-730 Warsaw

+48 605 19 11 19 info@wearenavirisk.com

CONTACT FORM

Do you have any questions? Write to us!