Exchange Exploit Attempts Surge Sixfold as Ransomware Lands

The number of global exploit attempts targeting vulnerable Microsoft Exchange servers has risen sixfold over the past few days, as Microsoft warned of a new ransomware threat to compromised systems.

Check Point Research has been monitoring the situation since Microsoft released out-of-band patches for four zero-day bugs back on March 3.

Reports began emerging that a Chinese state-backed group dubbed Hafnium was behind attacks in the wild exploiting the flaws. Then global attacks ramped-up massively, with some estimates claiming 30,000 victims in the US and over 100,000 round the world.

ESET said this was the result of multiple other APT groups getting involved.

Having previously said on Friday that exploit attempts on Exchange servers were doubling every few hours, Check Point then noted in an update on Sunday that they had surged sixfold over the past 72 hours.

The US accounted for 21% of these, followed by the Netherlands (12%) and Turkey (12%), with government and military the hardest hit sector (27%) followed by manufacturing (22%) and software vendors (9%).

Also on Friday, Microsoft tweeted that it had detected a new ransomware family being deployed after initial compromise of unpatched Exchange servers.

“Microsoft protects against this threat known as Ransom:Win32/DoejoCrypt.A, and also as DearCry,” it said.

Mandiant vice-president of analysis, John Hultquist, warned that this could be the start of a flood of exploitation activity by ransomware threat actors.

“Though many of the still unpatc ..

Support the originator by clicking the read the rest link below.