Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities
Summary: Volexity observed active in-the-wild exploitation of Microsoft Exchange vulnerabilities, with SSRF attacks (CVE-2021-26855) later dated to as early as January 3, 2021, used to steal the full contents of user mailboxes without any authentication. The attacker sent crafted HTTP POST requests with XML SOAP payloads to Exchange Web Services via OWA static resource files, and also used a remote code execution exploit through the Set-OabVirtualDirectory cmdlet to drop webshells including SIMPLESEESHARP, SPORTSBALL, China Chopper variants, and ASPXSPY.
Bottom line: The SSRF flaw needs only the server name and target account - no credentials - and Volexity confirmed it on a fully patched Exchange 2016 server running a fully patched Windows Server 2016, so patch status alone was no defense against mailbox theft.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2021-26855
- Related
- What Talos Incident Response learned from a recent Qakbot attack hijacking old email threads Cyber Risks ·CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·