Security News > 2021 > March > Microsoft Exchange Exploits Pave a Ransomware Path

Cybercriminals are now using compromised Microsoft Exchange servers as a foothold to deploy a new ransomware family called DearCry, Microsoft has warned.

The ransomware is the latest threat to beleaguer vulnerable Exchange servers, emerging shortly after Microsoft issued emergency patches in early March for four Microsoft Exchange flaws.

"We have detected and are now blocking a new family of ransomware being used after an initial compromise of unpatched on-premises Exchange Servers," Microsoft said on Twitter, Thursday.

DearCry first came onto the infosec space's radar after ransomware expert Michael Gillespie on Thursday said he observed a "Sudden swarm" of submissions to his ransomware identification website, ID-Ransomware.

Microsoft later confirmed that the ransomware was being launched by attackers using the four Microsoft Exchange vulnerabilities, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.

MalwareHunterTeam on Twitter said that victim companies of DearCry have been spotted in Australia, Austria, Canada, Denmark and the U.S. On Twitter, MalwareHunterTeam said the ransomware is "Not that very widespread." Thus far, three samples of the DearCry ransomware were uploaded to VirusTotal on March 9.

News URL

https://threatpost.com/microsoft-exchange-exploits-ransomware/164719/