Unpatched Microsoft Exchange Servers hit with cryptojacking

The hackers are after Monero.

Hackers are hitting Microsoft Exchange Servers with a Monero cryptominer, according to Sophos research published Tuesday.

The attackers, whom Sophos did not identify, began their apparently financially-motivated campaign shortly after Microsoft announced four zero-day vulnerabilities, according to Sophos.

The attackers have lost several of the servers they used to steal Monero — a kind of cryptocurrency — from victims, an indication that those with vulnerable machines are applying patches and hunting for compromises. But over the past month, the hackers have looked for new vulnerable servers to exploit, indicating some are still not paying attention to patching notices, Sophos warned.

There were fewer than 10,000 vulnerable systems in the U.S. as of March 22, according to the National Security Council, compared with 120,000 entities that were vulnerable when the vulnerabilities were discovered. As of late March over 92% of affected servers were patched or mitigated, according to Microsoft.

This particular Monero mining operation kicked off with a PowerShell command that retrieves a file from another compromised server’s Outlook Web Access logon path. This later allows the hackers to inject the miner, after which they delete the evidence it has been injected, according to the research.

According to files Sophos researchers examined, the attacker gave this collection of miners a nickname: “DRUGS.” 

Nation-state hackers and criminals have been rushing to take advantage of the Microsoft flaws since the company announced their existence last month, with security experts warning against an onslaught of webshell, ransomware and cryptojacking attacks. And although organizations have been working to patch against attacks, the Sophos research is a reminder that patching does not necessarily kick out hackers if they’ve already exploited the flaws.

In recent days the FBI has gone to court to remove malicious code from U.S. computers running the Microsoft Exchange Server email program in an effort to combat criminal and nation-state hacking taking advantage, the Department of Justice announced Tuesday. The DOJ asked for the court order precisely because some organizations “appeared unable” to clean up their systems properly.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure