It is rare for CyberSolace to write about specific technical vulnerabilities in its blog posts, but we are making an exception in this instance based on the severity of this new Microsoft Exchange mail server vulnerability.
Microsoft’s own advisory post quotes, “Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. In the attacks observed, the threat actor used these vulnerabilities to access on-premises Exchange servers which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures.”
We urgently advise and invite our clients to check their MS-Exchange Server installations for these vulnerabilities asap to ensure no exposure. The Microsoft Exchange Server team has created a script to run a check for HAFNIUM, that script is available <here>
Click the button below to read more.
