UPDATE: Exploitation of MS Exchange Vulnerabilities

Summary

On March 2, 2021, Microsoft reported that several vulnerabilities – referred to collectively as “ProxyLogon” – in on-premises Microsoft Exchange servers were being exploited by threat actors, including the HAFNIUM group. Since then, the exploitation of these vulnerabilities has become widespread and indiscriminate. Furthermore, proof-of-concept code was published to exploit these vulnerabilities, which will likely contribute to an increased targeting of vulnerable servers.

Recommendations

The NJCCIC highly advises organizations with on-premises Microsoft Exchange servers to patch vulnerable systems as soon as possible and search their network for signs of compromise using associated indicators of compromise (IOCs). Recommendations, IOCs, and additional details, including tactics, techniques, and procedures (TTPs), can be found in the NJCCIC Alert: Widespread Exploitation of Microsoft Exchange Vulnerabilities.