{"id":39917,"date":"2021-03-09T08:18:00","date_gmt":"2021-03-09T08:18:00","guid":{"rendered":"http:\/\/8e39b76b-fd6b-415b-9321-67ddfce0a102"},"modified":"2021-03-09T08:18:00","modified_gmt":"2021-03-09T08:18:00","slug":"everything-you-need-to-know-about-the-microsoft-exchange-server-hack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/everything-you-need-to-know-about-the-microsoft-exchange-server-hack\/","title":{"rendered":"Everything you need to know about the Microsoft Exchange Server hack"},"content":{"rendered":"
<\/div>\n

Four zero-day vulnerabilities in Microsoft Exchange Server are being actively exploited<\/a> by a state-sponsored threat group from China and appear to have been adopted by other cyberattackers in widespread attacks.<\/p>\n

\n

More Coverage<\/span> <\/h3>\n<\/p><\/div>\n

While in no way believed to be connected to the SolarWinds supply chain attack<\/a> that has impacted an estimated 18,000 organizations worldwide — so far — there is concern that lags in patching vulnerable servers could have a similar impact, or worse, on businesses. <\/p>\n

Also: <\/strong>Best VPNs<\/strong><\/a> \u2022 <\/strong>Best security keys<\/strong><\/a>  \u2022 <\/strong>Best antivirus<\/strong><\/a><\/p>\n

Here is everything you need to know about the security issues and our guide will be updated as the story develops. <\/p>\n

What happened?<\/h3>\n

Microsoft told security expert Brian Krebs<\/a> that the company was made aware of four zero-day bugs in “early” January. <\/p>\n

A DEVCORE researcher, credited with finding two of the security issues, appears to have reported them around January 5. Going under the handle “Orange Tsai,” the researcher tweeted<\/a>:<\/p>\n

\n

“Just report a pre-auth RCE chain to the vendor. This might be the most serious RCE I have ever reported.”<\/p>\n<\/blockquote>\n

According to Volexity<\/a>, attacks using the four zero-days may have started as early as January 6, 2021. Dubex reported<\/a> suspicious activity on Microsoft Exchange servers in the same month.<\/p>\n

<\/section>\n

On March 2, Microsoft released patches<\/a> to tackle the four severe vulnerabilities in Microsoft Exchange Server software. At the time, the company said that the bugs were being actively exploited in “limited, targeted attacks.” <\/p>\n

Microsoft Exchange Server is an email inbox, calendar, and collaboration solution. Users range from enterprise giants to small and medium-sized businesses worldwide.  <\/p>\n

While fixes have been issued<\/a>, the scope of potential Exchange Server compromise depends on the speed and uptake of patches — and the number of estimated victims continues to grow.  <\/p>\n

What are the vulnerabilities and why are they important?<\/h3>\n

The critical vulnerabilities<\/a> impact on-premise Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019. However, Exchange Online is not affected.  <\/p>\n