Security News > 2022 > May > New IceApple exploit toolset deployed on Microsoft Exchange servers
Security researchers have found a new post-exploitation framework that they dubbed IceApple, deployed mainly on Microsoft Exchange servers across a wide geography.
The researchers observed IceApple being deployed after the threat actor obtains initial access to the network belonging to organizations in various activity sectors: technology, academic, and government.
According to the researchers, IceApple has been deployed on Microsoft Exchange Server instances but it can also run under Internet Information Services web applications.
The threat actor behind IceApple has a solid grasp of the IIS software.
"Detailed analysis of the modules suggests that IceApple has been developed by an adversary with deep knowledge of the inner workings of IIS software" - CrowdStrike OverWatch.
A closer look reveals that the files have not been randomly created and they are loaded in a way that is not typical of Microsoft Exchange and IIS. Discovering IceApple was possible after CrowdStrike's Falcon cloud-based security solution triggered an alert at a new customer's Microsoft OWA deployment for.
News URL
Related news
- 17,000+ Microsoft Exchange servers in Germany are vulnerable to attack, BSI warns (source)
- Germany warns of 17K vulnerable Microsoft Exchange servers exposed online (source)
- These 17,000 unpatched Microsoft Exchange servers are a ticking time bomb (source)
- Microsoft fixes Outlook clients not syncing over Exchange ActiveSync (source)
- Hackers Exploit Misconfigured YARN, Docker, Confluence, Redis Servers for Crypto Mining (source)
- Microsoft confirms Windows Server issue behind domain controller crashes (source)
- Microsoft releases emergency fix for Windows Server crashes (source)
- Microsoft confirms memory leak in March Windows Server security update (source)
- Hackers exploit Ray framework flaw to breach servers, hijack resources (source)
- Week in review: Backdoor found in XZ utilities, weaponized iMessages, Exchange servers at risk (source)