Ransomwarecritical

LockBit affiliates compromise Microsoft Exchange servers to deploy ransomware

Security Affairsby @securityaffairsOct 12, 2022 · 05:54 UTC (Oct 12, 2022)1 min read2

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-21969 CVE-2022-41040 CVE-2022-41082

Tags: cve-2022-21969 cve-2022-41040 cve-2022-41082 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2022-21969	Microsoft Exchange Server Remote Code Execution Vulnerability	9.0	1%		Jan 11, 2022
CVE-2022-41040 +1 related CVE CVE-2022-41082	Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell)	8.8 group max	100%	KEVRansomwarePoC	Oct 3, 2022 KEV Sep 30, 2022

From the original article

1 min read at securityaffairs.com

Lockbit ransomware affiliates are compromising Microsoft Exchange servers to deploy their ransomware, experts warn. South-Korean cybersecurity firm AhnLab reported that Lockbit ransomware affiliates are distributing their malware via compromised Microsoft Exchange servers. In July 2022, two servers operated by a customer of the security firm were infected with LockBit 3.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.