1 of 9
The disclosure of four critical zero-day vulnerabilities in Microsoft Exchange Server jolted the information security community last week, and a rapid increase in attack activity has only exacerbated concerns.
Attacks exploiting the flaws were first spotted in January. They initially were limited and targeted, seemingly for espionage: the adversaries primarily targeted specific email accounts. Microsoft attributed the activity to a group it calls Hafnium, believed to operate out of China.
Then during the last weekend of February, researchers noticed a significant uptick in remote code execution. Attackers were writing Web shells to disk and launching operations to dump credentials, add user accounts, steal copies of Active Directory databases, and move laterally to other systems. The surge in activity – curious for an advanced Chinese attack group – pushed up the timeline of patches.
Microsoft deployed its fixes only a few days later, and the activity has continued to escalate. Check Point research reports hundreds of exploit attempts against organizations around the world, with the number of exploitation attempts doubling every two to three hours in the 24 hours ending March 11. Turkey is the most attacked country, followed by the US and Italy.
Researchers have also found there is microsoft exchange server attacks lessons defenders
