Over the past two days, the hackers have compromised almost 2000 Microsoft Exchange servers and installed backdoors on those hacked 2000 Microsoft Exchange servers through unpatched ProxyShell vulnerabilities.
Cybersecurity experts of Huntress Labs security firm have discovered this incident and they began after the publication of a PoC exploit earlier this month. Due to such frequent attacks, just two weeks ago, the network initiated its scans in search of vulnerable servers.
ProxyShell and the vulnerabilities
ProxyShell is a Microsoft Exchange bug which is initially discovered by Orange Tsai, a Taiwanese security researcher.
A ProxyShell security flaw consists of three different security flaws, through which any remote attacker can easily gain access and take control of Microsoft Exchange email servers.
Here’s the list of three security flaws:-
- CVE-2021-34473: This security flaw provides a mechanism for pre-authentication remote code execution, enabling malicious actors to remotely execute code on an affected system.
- CVE-2021-34523: This vulnerability enables malicious actors to execute arbitrary code post-authentication on Microsoft Exchange servers due to a flaw in the PowerShell service not properly validating access tokens.
- CVE-2021-31207: This security bug enables post-authentication malicious actors to execute arbitrary code in the context of the system and write arbitrary files.
A gainst vulnerable Exchange servers, all these vulnerabilities are actively exploited by the threat actors, as reported by the cybersecurity analysts of Huntress.
Moreover, on August 17 and 18, the experts of Huntress noted and reported more than 100 incidents that are related to this exploit.
The Taiwanese security researcher, Orange Tsai discovered that ProxyShell is part of a trio of attack chains, and here they are mentioned below:-
Apart from this, in April this year during the Pwn2Own 2021 hacking contest, Tsai earned $200,000 for a successful server compromise by using the ProxyShell exploit.
More than 30,400 Exchange servers are vulnerable
It seems that despite the availability of fixes for these vulnerabilities that are described above, the system admins do not seem to be in hurry to install them.
On August 8, a scan was conducted by ISC SANS, and in their scan report, they claimed that currently there are more than 30,400 Exchange servers from a total of 100,000 systems that are vulnerable to such attacks since they were not patched.
Patch levels and appropriate hash for MSExchangeRPC
Here’s the list of patch levels and appropriate hash for MSExchangeRPC mentioned below:-
Exchange 2019 CU10 + KB5004780 = v15.2.922.13
Exchange 2019 CU9 + KB5004780 = v15.2.858.15
Exchange 2016 CU21 + KB5004779 = v15.1.2308.14
Exchange 2016 CU20 + KB5004779 = v15.1.2242.12
Exchange 2013 CU23 + KB5004778 = v15.0.1497.23
Over 2000 Exchange servers were hacked
During their scan, they detected that all the compromised 2000 Microsoft Exchange servers were hacked through ProxyShell, and not only that even they also found more than 140 different web shells as well on those servers.
While all these hacked Exchange servers were owned by several organizations like:-
- Construction companies
- Seafood manufacturers
- Industrial equipment suppliers
- Auto repair shops
- Small airport
Here, things got more aggravated when a user on a Russian-speaking hacker forum published a list of more than 100,000 internet-accessible Exchange servers.
So, what the hackers need here, is to arm themselves with an available exploit and start bombarding the servers according to the list.