Threat Advisory: HAFNIUM and Microsoft Exchange zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-24085 | Microsoft Exchange Server Spoofing Vulnerability | 6.5 | 5% | ||
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 group max | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.77.192.219 | se on Snort.org . IOCs IP addresses leveraged by attackers. 103.77.192.219 104.140.114.110 104.250.191.110 108.61.246.56 149.28.14.163 |
| ipv4 | 104.140.114.110 | . IOCs IP addresses leveraged by attackers. 103.77.192.219 104.140.114.110 104.250.191.110 108.61.246.56 149.28.14.163 157.230.221.198 |
| ipv4 | 104.250.191.110 | sses leveraged by attackers. 103.77.192.219 104.140.114.110 104.250.191.110 108.61.246.56 149.28.14.163 157.230.221.198 167.99.168.251 |
| ipv4 | 108.61.246.56 | y attackers. 103.77.192.219 104.140.114.110 104.250.191.110 108.61.246.56 149.28.14.163 157.230.221.198 167.99.168.251 185.250.151.72 |
| sha256 | 097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e | 63ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0 097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e 2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c |
| sha256 | 1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944 | 7f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d 1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944 Additional References CISA Alert - Mitigate Microsoft Excha |
| sha256 | 2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1 | 9cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e 2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1 65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8d |
| sha256 | 2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a | 80edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928 2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07 |
| sha256 | 406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928 | 3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2 406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928 2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008 |
| sha256 | 4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea | 0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1 4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea 811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6 |
| sha256 | 511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1 | e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5 511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1 4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f1 |
| sha256 | 65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5 | ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1 65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5 511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c |
| sha256 | 811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d | 770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea 811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d 1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e |
| sha256 | 893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2 | .56.98.146 5.254.43.18 80.92.205.81 Web Shell SHA256 Hashes 893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2 406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff |
| sha256 | b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0 | 333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0 097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc0 |
From the original article
4 min read at blog.talosintelligence.com
Microsoft released patches for four vulnerabilities in Exchange Server on March 2, disclosing that these vulnerabilities were being exploited by a previously unknown threat actor, referred to as HAFNIUM . The vulnerabilities in question — CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 and CVE-2021-27065 — affect Microsoft Exchange Server 2019, 2016, 2013 and the out-of-support Microsoft Exchange Server 2010.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.