Security News > 2021 > March > As attacks on Exchange servers escalate, Microsoft investigates potential PoC exploit leak
Microsoft Exchange servers around the world are still getting compromised via the ProxyLogon and three other vulnerabilities patched by Microsoft in early March.
A. Human operated ransomware attacks are utilizing the Microsoft Exchange vulnerabilities to exploit customers.
The source of the Microsoft Exchange exploit still unknown.
Microsoft is reportedly investigating whether those who created the exploit might have obtained a "Proof of concept" attack code that the company distributed on February 23 to 80 or so security partners through its Microsoft Active Protections Program.
Microsoft Security Team says that on-premises Exchange servers are most often used by small and medium-sized businesses, "Although larger organizations with on-premises Exchange servers have also been affected."
Microsoft has released Exchange On-Premises Mitigation Tool, which quickly performs the initial steps for mitigating the ProxyLogon flaw on any Exchange server and attempts to remediate found compromises.
News URL
http://feedproxy.google.com/~r/HelpNetSecurity/~3/tLAkZ4lHpTk/
Related news
- Microsoft fixes 6 zero-days under active attack (source)
- Windows Server August updates fix Microsoft 365 Defender issue (source)
- Xeon Sender Tool Exploits Cloud APIs for Large-Scale SMS Phishing Attacks (source)
- Cybercriminals exploit file sharing services to advance phishing attacks (source)
- Microsoft: August updates cause Windows Server boot issues, freezes (source)
- Microsoft: Exchange Online mistakenly tags emails as malware (source)
- New QR Code Phishing Campaign Exploits Microsoft Sway to Steal Credentials (source)
- BlackByte Ransomware Exploits VMware ESXi Flaw in Latest Attack Wave (source)
- Brain Cipher claims attack on Olympic venue, promises 300 GB data leak (source)
- Volt Typhoon Hackers Exploit Zero-Day Vulnerability in Versa Director Servers Used by MSPs, ISPs (source)