Security News > 2021 > March > Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails
Microsoft Corp. today released software updates to plug four security holes that attackers have been using to plunder email communications at companies that use its Exchange Server products.
The patches released today fix security problems in Microsoft Exchange Server 2013, 2016 and 2019.
Microsoft says the flaws are being used by a previously unknown Chinese espionage group that's been dubbed "Hafnium," which is known to launch its attacks using hosting companies based in the United States.
According to Microsoft, Hafnium attackers have been observed combining all four zero-day flaws to target organizations running vulnerable Exchange Server products.
The attackers used CVE-2021-26857 to run code of their choice under the "System" account on a targeted Exchange server.
Microsoft technical advisory on the four Exchange Server flaws.
News URL
Related news
- Microsoft: Exchange Online mistakenly tags emails as malware (source)
- Windows Server August updates fix Microsoft 365 Defender issue (source)
- Microsoft: August updates cause Windows Server boot issues, freezes (source)
- Microsoft fixes Windows Server performance issues from August updates (source)
- Microsoft ends development of Windows Server Update Services (WSUS) (source)
- Microsoft fixes Outlook email sending issue for users with many folders (source)
- Critical Zimbra RCE flaw exploited to backdoor servers using emails (source)
- Over 5,000 Fake Microsoft Notifications Fueling Email Compromise Campaigns (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-03-03 | CVE-2021-26857 | Deserialization of Untrusted Data vulnerability in Microsoft Exchange Server Microsoft Exchange Server Remote Code Execution Vulnerability | 7.8 |