LockBit affiliates compromise Microsoft Exchange servers to deploy ransomware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-21969 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.0 | 1% |
| — | ||
| CVE-2022-41040 +1 in the same advisory: …41082 | Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell) CVE-2022-41040 is a server-side request forgery (SSRF, CWE-918) vulnerability in Microsoft Exchange Server, publicly tracked under the name "ProxyNotShell" together with CVE-2022-41082. It is triggered when an attacker sends crafted HTTP requests to exposed Exchange web endpoints (such as Autodiscover), causing the server to issue attacker-influenced requests to itself. On its own the SSRF coerces authenticated server-side requests, but when chained with the CVE-2022-41082 remote code execution flaw it gives the attacker code execution on the Exchange server, typically followed by web shells, data access, and — in observed campaigns — ransomware deployment. Organizations running on-premises Microsoft Exchange Server are affected; the source data lists only Microsoft Exchange Server and does not specify affected version ranges, and hosted Exchange Online is a separate product not listed here. The vulnerability is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-30 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days; no public PoC is listed. Do: Apply Microsoft's Exchange Server security updates per vendor instructions immediately, as required by the CISA KEV catalog. As interim mitigation, restrict or block untrusted internet access to Exchange web endpoints (e.g., Autodiscover, OWA, ECP), and review IIS logs for suspicious crafted requests indicating SSRF or the chained CVE-2022-41082 exploitation. Given documented ransomware use, prioritize any internet-facing Exchange server and hunt for web shells and post-exploitation activity. | 8.8 group max | 100% | KEV ransomware PoC |
| mass≈250,000+ internet-exposed Exchange servers (public scans of exposed OWA/ECP/Exchange endpoints) |
Full article344 words · extracted from securityaffairs.com · click to collapse
Lockbit ransomware affiliates are compromising Microsoft Exchange servers to deploy their ransomware, experts warn.
South-Korean cybersecurity firm AhnLab reported that Lockbit ransomware affiliates are distributing their malware via compromised Microsoft Exchange servers.
In July 2022, two servers operated by a customer of the security firm were infected with LockBit 3.0 ransomware.
Threat actors initially deployed web shell on a compromised Exchange server, then it took just 7 days to escalate privileges to Active Directory admin and stole roughly 1.3 TB of data before encrypting systems hosted in the network.
According to the researchers, the attackers allegedly exploited a zero-day vulnerability in Microsoft Exchange Server.
“Looking at the Microsoft Exchange Server vulnerability history, the remote code execution vulnerability was disclosed on December 16, 2021 (CVE-2022-21969), the privilege escalation vulnerability was disclosed in February 2022, and the most recent vulnerability was on June 27. Information Disclosure Vulnerability vulnerability. That is, among the vulnerabilities disclosed after May, there were no reports of vulnerabilities related to remote commands or file creation.” reads the report published by AhnLab. “Therefore, considering that WebShell was created on July 21, it is expected that the attacker used an undisclosed zero-day vulnerability.
The experts argued that the attackers likely did not exploit recently disclosed CVE-2022-41040 and CVE-2022-41082 vulnerabilities.
Some prominent experts, including the popular Kevin Beaumont said that he is not convinced it’s a zero-day.
https://twitter.com/GossiTheDog/status/1579799118779514882
The vulnerability researcher Will Dormann pointed out that the report doesn’t include evidence of exploiting of a new zero-day vulnerability.
So far I've only skimmed a translated version of the page, but what evidence is provided that it's a different vulnerability?
— Will Dormann (@wdormann) October 11, 2022
Bleeping Computer pointed out that at least three vulnerabilities in Microsoft Exchange, discovered by Zero Day Initiative vulnerability researcher Piotr Bazydlo, have yet to be patched.
The three issues, tracked by ZDI as ZDI-CAN-18881, ZDI-CAN-18882, and ZDI-CAN-18932, were reported on September 20, 2022.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Lockbit)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/136968/cyber-crime/microsoft-exchange-lockbit-ransomware.html