Exchange Exploit Attempts Surge Sixfold as Ransomware Lands

The number of global exploit attempts targeting vulnerable Microsoft Exchange servers has risen sixfold over the past few days, as Microsoft warned of a new ransomware threat to compromised systems.

Check Point Research has been monitoring the situation since Microsoft released out-of-band patches for four zero-day bugs back on March 3.

Reports began emerging that a Chinese state-backed group dubbed Hafnium was behind attacks in the wild exploiting the flaws. Then global attacks ramped-up massively, with some estimates claiming 30,000 victims in the US and over 100,000 round the world.

ESET said this was the result of multiple other APT groups getting involved.

Having previously said on Friday that exploit attempts on Exchange servers were doubling every few hours, Check Point then noted in an update on Sunday that they had surged sixfold over the past 72 hours.

The US accounted for 21% of these, followed by the Netherlands (12%) and Turkey (12%), with government and military the hardest hit sector (27%) followed by manufacturing (22%) and software vendors (9%).

Also on Friday, Microsoft tweeted that it had detected a new ransomware family being deployed after initial compromise of unpatched Exchange servers.

“Microsoft protects against this threat known as Ransom:Win32/DoejoCrypt.A, and also as DearCry,” it said.

Mandiant vice-president of analysis, John Hultquist, warned that this could be the start of a flood of exploitation activity by ransomware threat actors.

“Though many of the still unpatched organizations may have been exploited by cyber-espionage actors, criminal ransomware operations may pose a greater risk as they disrupt organizations and even extort victims by releasing stolen emails. Ransomware operators can monetize their access by encrypting emails or threatening to leak them, a tactic they have recently adopted,” he explained.

“This attack vector may be particularly attractive to ransomware operators because it is an especially efficient means of gaining domain admin access. That access enables them to deploy encryption across the enterprise. In cases where organizations are unpatched, these vulnerabilities will provide criminals a faster path to success.”

Hultquist noted that many of the most vulnerable organizations will be SMBs or state and local government and school organizations who have scant resources to mitigate the issue.