Microsoft Exchange Server Attack Escalation Prompts Patching Panic

The critical Exchange Server vulnerabilities patched last week by Microsoft are being weaponized in widespread attacks against organizations worldwide. Attacks have escalated over the past two weeks, prompting responses from US government and the security community. 

News of the four vulnerabilities emerged on March 2, when Microsoft issued patches for CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. These flaws affect Microsoft Exchange Server versions 2013, 2016, and 2019, though the company notes Microsoft Exchange Server 2010 is being updated for Defense in Depth purposes. Exchange Online is not affected.

Microsoft, which learned of these vulnerabilities in early January, initially reported they were being exploited in "limited and targeted attacks" by Hafnium, a group it believes is state-sponsored and operates out of China. Officials said this was the only actor it had seen weaponizing these exploits, which it used to primarily target organizations in the US. 

But other security experts say there are likely multiple threat groups behind the wave of malicious activity going after Exchange Servers.

This activity accelerated toward the end of February, when Volexity researchers who found some of the zero-days noticed an increase in instances of remote code execution (RCE). In all cases, attackers were writing Web shells to disk and doing operations to dump credentials, add user accounts, steal copies of Active Directory databases, and move laterally to other systems.

What had previously been "low and slow" activity had quickly escalated into a lot of noise. 

"While it started out as targeted espionage campaign, they engaged in reckless and dangerous behavior by scanning/compromising Exchange servers across the entire IPv4 address space with webshells that can now be used by other actors, including ransomware crews," Dmitri Alperovitch, chairman of the Silverado Policy Accelerator and cofounder of CrowdStrike, said in a tweet. 

Intelligence from multiple sources indicates that the malicious activity has grown more widespread since March 2. At least 30,000 organizations in the US have been affected, KrebsOnSecurity reports. Since early March, Kaspersky has detected related attacks on more than 1,200 users, "with this number continually growing." Most of these targets are in Germany (26.9%), with others in Italy (9%), Austria (5.72%), Switzerland (4.81), and the US (4.73%), researchers report. The European Banking Authority is among organizations affected outside the US. 

Katie Nickels, director of intelligence for Red Canary, says they began to see an increase in suspicious Web shell activity targeting Exchange servers on Feb. 28, days before Microsoft's disclosure of Hafnium activity. Red Canary's data shows multiple clusters of Web shell activity; for example, Web shells they saw dropped from Feb. 28 through March 3 acted differently from Web shells they saw dropped on March 5. 

"Each of these clusters look a bit different, which leads us to assess there may be multiple adversaries exploiting these vulnerabilities," Nickels says. "One thing we don't know right now is if these adversaries are cooperating somehow and just using different TTPs, or if they are distinct adversaries who are not coordinating." 

Multiple Attack Groups Likely Involved

Red Canary isn't the only security firm tracking this activity in "clusters." In a blog post posted last week, Mandiant researchers explained how they are tracking the attacks in three clusters: UNC 2639, UNC2640, and UNC2643. While Microsoft initially attributed this activity to Hafnium, the rapid acceleration of activity calls into question whether other groups might be responsible.

"Hafnium is definitely not the only actor involved in this activity," Kaspersky researchers say in an email to Dark Reading, noting there were other attackers using some of these exploits before a patch was released. After March 2, they say, the number of attackers has increased. 

With each day since the patches were released, Kaspersky researchers report a higher number of automated attempts of at least one of the flaws (CVE-2021-26855). Their intelligence shows the attacks peaked on March 5 and have since plateaued; however, they note this isn't unusual. 

"This is a typical reaction we see in the wild, especially if a working exploit has also been produced," they explain. "It's a sort of race against time between attackers looking to capitalize on the 'patch gap' and defenders trying to mitigate the risk." They note attackers are most likely using various means to set up persistent access, which they can use as they like in the future.

Most of the Web shells Red Canary has observed provide attackers with an initial foothold. However, Nickels notes that fewer attacks conduct significant post-exploitation beyond that foothold. Researchers have seen some activity clusters execute commands to learn more about the environment; others have added scheduled tasks for persistence and beaconed back to command-and-control domains. Microsoft initially reported that Hafnium compressed stolen data and exported mailbox data; however, this is not occurring on every compromised server. 

"The challenge of having multiple activity clusters exploiting these vulnerabilities is that each of those could represent different adversaries with different intents," Nickels says. The fact that much of this activity is noisy and visible to defenders indicates some adversaries don't care much about hiding their presence. She notes the team is cautious to clearly distinguish clusters rather than attributing all activity to China, which she says is an assessment they cannot make. 

In his Twitter thread, Alperovitch says this activity "deserves a significant response from the Biden administration," especially if damaging ransomware attacks emerge in coming weeks. 

White House press secretary Jen Psaki mentioned the activity in a March 5 press briefing, and the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert urging organizations to patch the vulnerabilities "immediately" or disconnect their Microsoft Exchange Servers.

"We are concerned that there are a large number of victims and are working with our partners to understand the scope of this," Psaki said, later adding that "network owners also need to consider whether they have already been compromised and should immediately take appropriate steps."

National security advisor Jake Sullivan said in a tweet that officials are closely tracking Microsoft patches for these vulnerabilities as well as watching for potential compromises at US think tanks and defense industrial base entities. He encouraged network owners to patch as soon as possible, as did former CISA director Chris Krebs, who calls this "the real deal" in a tweet.

"If your organization runs an [Outlook Web Access] server exposed to the Internet, assume compromise between 02/26-03/03," Krebs said.

What Organizations Should Do in Response

The most obvious advice is to apply patches for these critical flaws, which will protect targets from potential compromise. But as Nickels points out, installing patches won't tell you if you've already been a target – let alone remediate an active attack.

"If security teams can gather visibility into process lineage and command line parameters associated with the Windows IIS worker process, then they may be able to hunt or build detection for this and other Exchange web shell activity," she says. Microsoft, Volexity, and other companies have shared information that can help businesses check for compromise.

Should they discover an attack, IT and security teams are advised to run a "full and thorough" incident response process, Kaspersky researchers say. 

Most of the businesses that rely on Exchange server are late mainstream organizations, small- to medium-sized businesses, and some large enterprises that use on-premise Exchange for automated email systems, says Gartner research vice president Peter Firstbrook. Those who are still on-premise because they lack budget and time to migrate are most at risk, he notes.

"Risk-based patching is critical," Firstbrook says, adding that "full exposure of corporate email is a big risk to most organizations, so this should have been a priority." The key is knowing which flaws are high risk and being able to prioritize them, which requires a strong vulnerability and patch management program – something often lacking in small companies with slim IT budgets. 

As with other older enterprise software, patching Exchange server can be a difficult process, especially if the business is behind on updates. For this reason, Microsoft has provided mitigations for those that can't patch quickly. Officials note these mitigations do not provide full protection, nor do they provide remediation if an Exchange server has already been compromised. CISA has also issued an alert for the alternative mitigations.

Microsoft responded to request for comment stating it's working with CISA, other government agencies, and security companies to continue providing guidance and mitigation steps. 

"The best protection is to apply updates as soon as possible across all impacted systems," a spokesperson says, noting that affected businesses should contact Microsoft's support teams for additional help and resources.