Microsoft on Friday released alternative mitigation measures for organizations who have not been able to immediately apply emergency out-of-band patches released earlier this week that address vulnerabilities being exploited to siphon e-mail data from corporate Microsoft Exchange servers.
“These mitigations are not a remediation if your Exchange servers have already been compromised, nor are they full protection against attack,” Microsoft warned in a blog post. “We strongly recommend investigating your Exchange deployments using the hunting recommendations here to ensure that they have not been compromised. We recommend initiating an investigation in parallel with or after applying one of the following mitigation strategies.”
Microsoft also provided a nmap script to help customers discover vulnerable servers within their infrastructure.
Security researchers have warned that multiple cyber-espionage groups have been targeting vulnerable Exchange servers. Some reports suggest that 30,000 or more organizations may have been hacked via the Exchange security holes.
Analysts say that HAFNIUM, a state-sponsored hacking group operating out of China, has been on an an active hacking spree with a massive espionage campaign underway to siphon data from organizations globally.
“This is the real deal. If your organization runs an OWA server exposed to the internet, assume compromise between 02/26-03/03,” Ex-CISA Chief Chris Krebs tweeted. “Check for 8 character aspx files in C:\inetpubwwwrootaspnet_clientsystem_web. If you get a hit on that search, you’re now in incident response mode."
The U.S. Cybersecurity and Infrastructure Security (CISA) also microsoft shares additional mitigations exchange server vulnerabilities under attack
