Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-26855+3 related CVEs | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 group max | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 112.160.243.172 | and came from the following IP addresses: 156.194.127[.]178 112.160.243[.]172 221.179.87[.]175 73.184.77[.]174 41.237.156[.]15 223.16.2 |
| ipv4 | 121.150.12.35 | 2:35:27, by navigating to /aspnet_client/supp0rt.aspx from 121.150.12[.]35 . The HTTP request included a parameter labeled 6b83ccc96 |
| ipv4 | 156.194.127.178 | cesClient/0.0.0.0 and came from the following IP addresses: 156.194.127[.]178 112.160.243[.]172 221.179.87[.]175 73.184.77[.]174 41.237 |
| ipv4 | 164.68.156.31 | before the actor appeared to switch their IP address to use 164.68.156[.]31 . The short period of time between the two inbound reques |
| ipv4 | 218.103.234.104 | 84.77[.]174 41.237.156[.]15 223.16.210[.]90 63.76.255[.]110 218.103.234[.]104 83.110.215[.]7 After several days of inactivity, the acto |
| ipv4 | 221.179.87.175 | following IP addresses: 156.194.127[.]178 112.160.243[.]172 221.179.87[.]175 73.184.77[.]174 41.237.156[.]15 223.16.210[.]90 63.76.255 |
| ipv4 | 223.16.210.90 | .243[.]172 221.179.87[.]175 73.184.77[.]174 41.237.156[.]15 223.16.210[.]90 63.76.255[.]110 218.103.234[.]104 83.110.215[.]7 After se |
| ipv4 | 41.237.156.15 | 27[.]178 112.160.243[.]172 221.179.87[.]175 73.184.77[.]174 41.237.156[.]15 223.16.210[.]90 63.76.255[.]110 218.103.234[.]104 83.110. |
| ipv4 | 45.77.140.214 | 7:09, the actor appears to have changed their IP address to 45.77.140[.]214 and successfully downloaded the cabinet file f4[redacted] |
| ipv4 | 63.76.255.110 | 79.87[.]175 73.184.77[.]174 41.237.156[.]15 223.16.210[.]90 63.76.255[.]110 218.103.234[.]104 83.110.215[.]7 After several days of in |
| ipv4 | 73.184.77.174 | esses: 156.194.127[.]178 112.160.243[.]172 221.179.87[.]175 73.184.77[.]174 41.237.156[.]15 223.16.210[.]90 63.76.255[.]110 218.103.2 |
| ipv4 | 78.141.218.225 | AM, the actor again changed their IP address – this time to 78.141.218[.]225 – and continued attempting to download this cabinet file. |
| ipv4 | 83.110.215.7 | .156[.]15 223.16.210[.]90 63.76.255[.]110 218.103.234[.]104 83.110.215[.]7 After several days of inactivity, the actor first accesse |
| md5 | 54242e9b610a7ca15024a784969c9e0d | ich would run code provided by the actor within a parameter 54242e9b610a7ca15024a784969c9e0d : <script language="JScript" runat="server">function Page_L |
| md5 | 6b83ccc96b4abd4cea1c7c607688a8ad | ecute to the supp0rt.aspx webshell within a parameter named 6b83ccc96b4abd4cea1c7c607688a8ad . We believe with high confidence that the actors used the |
From the original article
10 min read at unit42.paloaltonetworks.com
The recently discovered and patched Microsoft Exchange vulnerabilities ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 and CVE-2021-27065 ) have garnered considerable attention due to their mass exploitation and the severity of impact each exploitation has on the affected organization.
By Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.