New Delhi: In the face of multiple hacking attempts on its corporate mail servers around the world, Microsoft has reiterated the warning that patching a system does not necessarily remove attacker access.
The main vulnerabilities of Microsoft’s corporate email servers have left cybersecurity experts in awe as this free-for-all attack opportunity is now being exploited by a large number of criminal gangs, state-backed threat actors and of opportunistic “script kiddies,” F -Secure researchers said last week.
Although many on-premises Microsoft Exchange servers have been patched, a new investigation has revealed that several threats are still lurking on already compromised systems.
According to the Microsoft 365 Defender Threat Intelligence team, many compromised systems have yet to receive secondary action, “such as human-made ransomware attacks or data exfiltration, indicating that the attackers could establish and keep their access for possible subsequent actions ”.
“These actions may involve performing follow-up attacks through persistence on Exchange servers that they have already compromised, or using credentials and data stolen during these attacks to compromise networks through persistence. ‘other vectors of entry,’ the tech giant said in its latest update.
Taiwanese electronics and computer maker Acer has already been hit by a ransomware attack in which hackers demand $ 50 million, the largest known ransom to date.
According to Bleeping Computer, hackers accessed Acer documents that include financial spreadsheets, bank balances and bank communications, compromising its network through a Microsoft Exchange server vulnerability.
Previous reports have claimed that five different hacking groups (including the China-backed hacking group called “Hafnium”) are exploiting vulnerabilities in Microsoft’s corporate email servers.
According to Microsoft, attackers who included the exploit in their toolkits, whether by modifying public proof of concept exploits or their own research, took advantage of their window of opportunity to gain access to as many systems as possible. .
“Some attackers were advanced enough to remove other attackers from systems and use multiple persistence points to maintain access to a network,” the company noted.
Microsoft said it is important to note that with “some post-compromise techniques attackers can gain highly privileged persistent access, but most subsequent attacker activity can be mitigated by applying the principle of least privilege. and reducing lateral movements ”.
According to the F-Secure report, the countries currently registering the most detections (in descending order) are Italy, Germany, France, United Kingdom, United States, Belgium, Kuwait, Sweden, the Netherlands and Taiwan.