Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server
Summary: On Mar. 2, 2021, Volexity reported in-the-wild exploitation of four Microsoft Exchange Server vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065 - which, chained together, let adversaries authenticate as an Exchange server and gain remote access. Unit 42 reports multiple threat actors exploiting these zero-days, with post-exploitation activity including China Chopper webshells, Procdump against LSASS to obtain credentials, and 7zip or Winrar staging of stolen data for exfiltration, and notes Microsoft released an emergency out-of-band update to patch them.
Key Takeaway: The entry point is an on-premises Exchange Server accepting untrusted connections on port 443 - and once inside, attackers dump LSASS memory for credentials, meaning a single unpatched server can hand over the keys to the rest of your environment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-26855CVE-2021-26857CVE-2021-26858CVE-2021-27065
- Related
- Microsoft Exchange Server Attack Timeline Cyber Risks ·Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·