5 September 2021: The number of users attacked by exploits targeting vulnerabilities in Microsoft Exchange Servers, blocked by Kaspersky products, grew by 170% in August from 7,342 to 19,839 users, with the United Arab Emirates witnessing a182% increase throughout the month. According to Kaspersky experts, this staggering growth is linked to the increasing number of attacks that attempt to exploit previously disclosed vulnerabilities in the product, and the fact that users do not patch vulnerable software right away, thereby widening the potential attack surface.
Vulnerabilities inside Microsoft Exchange Server caused a lot of chaos this year. On March 2, 2021, the public learnt about ‘in-the-wild’ exploitations of zero-day vulnerabilities inside Microsoft Exchange Server, which were then exploited in a wave of attacks on organisations worldwide. Later in the year, Microsoft also patched a series of the so-called ProxyShell vulnerabilities – CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207. Together these vulnerabilities represent a critical threat and enable an actor to bypass authentication and execute code as a privileged user. Even though the patches for these vulnerabilities were released a while ago, cybercriminals did not hesitate to exploit them, with 74,274 Kaspersky users encountering exploits for MS Exchange vulnerabilities in the past six months.
Furthermore, as Cybersecurity and Infrastructure Security Agency (CISA) in the USA warned on August 21, ProxyShell vulnerabilities are now actively exploited by cybercriminals in a recent wave of attacks. In its advisory, released on August 26, Microsoft explained that an Exchange server is vulnerable if it is not running a Cumulative Update (CU) with at least the May Security Update (SU).
According to Kaspersky telemetry, in the last week of the summer, over 1,700 users were attacked using ProxyShell exploits daily, leading to the number of users attacked in August 2021 to grow by 170% compared to July 2021. This reflects the large scale problem these vulnerabilities represent, if left unpatched.
“The fact that these vulnerabilities are being actively exploited comes as no surprise – quite often, 1-day vulnerabilities – the ones that have already been disclosed and have patches released by developers – represent an even bigger threat as they are known to a wider array of cybercriminals who try their luck in penetrating any network they can get their hands on. This active growth of attacks demonstrates once again why it is so essential to patch vulnerabilities as soon as possible to prevent the networks from being compromised. We strongly recommend following Microsoft’s recent advisory to mitigate any wider risks”, comments Evgeny Lopatin, security researcher, Kaspersky.
Kaspersky products protect against exploits that abuse ProxyShell vulnerabilities with Behavior Detection and Exploit Prevention components and detect exploitation with the following verdicts:
- PDM:Exploit.Win32.Generic
- HEUR:Exploit.Win32.ProxyShell.
- HEUR:Exploit.*.CVE-2021-26855.
To protect against attacks exploiting the aforementioned vulnerability, Kaspersky recommends the following:
- Update Exchange Server as soon as possible
- Focus defense strategy on detecting lateral movements and data exfiltration to the internet. Pay special attention to outgoing traffic to detect cybercriminal connections. Back up data regularly. Make sure you can quickly access it in an emergency
- Use solutions like Kaspersky Endpoint Detection and Response and the Kaspersky Managed Detection and Response service, which help to identify and stop an attack in the early stages, before the attackers achieve their goals
- Use a reliable endpoint security solution such as Kaspersky Endpoint Security for Business that is powered by exploit prevention, behavior detection and a remediation engine that can roll back malicious actions. KESB also has self-defense mechanisms that can prevent its removal by cybercriminals
