Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials
Summary: On March 6, 2021, an unknown actor exploited Microsoft Exchange Server vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) to write a supp0rt.aspx webshell to a financial institution's server in EMEA, then returned on March 12 to run PowerShell commands three seconds apart from two different IP addresses to enumerate processes and dump LSASS memory. The credential harvesting failed: the download request for the LSASS memory dump returned a 404 Not Found, and Cortex XDR's Password Theft Protection module had already removed pointers to the credentials from the dumped memory.
Why it matters: Unit 42 found 177 webshells sharing the same attributes and behavior across industries and geographies, indicating an opportunistic actor or actors scanning for Exchange servers rather than working from a target list - and the automation that issued two scripts three seconds apart from different IPs is built to make correlation hard.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2021-26855CVE-2021-26857CVE-2021-26858CVE-2021-27065
- Related
- Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·