Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails
Summary: Microsoft released out-of-band patches for four Exchange Server flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) affecting Exchange Server 2013, 2016 and 2019, which a previously unidentified Chinese espionage group Microsoft calls Hafnium has been chaining together to read email. Volexity, credited with reporting the attacks, first spotted them on Jan. 6, 2021, and its president Steven Adair said the exploits require no special knowledge to use against internet-exposed servers.
Key Takeaway: Hafnium targets infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and NGOs, and the SSRF flaw carries a CVSS score of 9.1 - and Microsoft and Volexity know of no public exploit code yet, which may only last days.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-26855CVE-2021-26857CVE-2021-26858CVE-2021-27065
- Related
- Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server Cyber Risks ·Microsoft Exchange Server Attack Timeline Cyber Risks ·Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·