Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells
Summary: Unit 42 analyzed China Chopper webshells dropped into Exchange Offline Address Book ASPX pages via CVE-2021-27065, a post-authentication arbitrary file write vulnerability, in attacks attributed to the suspected China-based group HAFNIUM. As of March 4, 2021, 81 unique matching samples had been uploaded to VirusTotal, with the most prevalent key, NO9BxmCXw0JE, appearing in OAB files modified on Feb. 28 and March 1, 2021, before the March 2 Volexity publication.
Why it matters: The OAB metadata showed compromises minutes apart across investment banks, car dealerships, water conservatories, law firms and hospitality, and some servers were hit again later with the identical webshell and key - evidence of automated scanning that does not check what it has already owned.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-27065
- Related
- Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·CVE-2021-27065: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021