Our team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers that could lead to Remote Code Execution (RCE) for an authenticated user.
Our ThreatOps team discovered , and the team began to research and see if anyone else in the community had flagged it. We found from Security Researcher Kevin Beaumont, where he notes that 鈥渟ignificant numbers of Exchange servers have been backdoored - including a honeypot.鈥
We鈥檒l continue to update this blog with our latest findings and research.
Update 1 (9/29/22 @ 8:18pm ET): Clarified GTSC聽updated language to affirm this is a new vulnerability and 0-day.
Update 2 (9/30/22 @ 9:23am ET): Included Microsoft official details and CVE identifiers.
As of 9/29/22 @ 8:18pm ET, the GTSC聽has been updated to reaffirm that this is a new 0-day vulnerability and Remote Code Execution exploit. Unfortunately, this means that the latest patch and Cumulative Updates are not sufficient to protect Exchange servers from this threat. Currently, there are no known proof-of-concept scripts or exploitation tooling available in the wild.
The best thing you can do right now is to in GTSC's聽post.
As another resource to monitor, the is tracking two issues related to the observed exploitation so far, tagged as ZDI-CAN-18333 and ZDI-CAN-18802.
As of 9/30/22 @ 9:23am ET, we see that about this issue. They have announced there are two new vulnerabilities:
The first vulnerability can be used to achieve the second, but it must be clear that this is only an attack vector for an聽authenticated adversary. Currently, no official patch has been released by Microsoft yet.
, as a significant number may be running a hybrid server that migrated to Exchange Online and are still vulnerable to this post-authentication threat. Shodan reports over 1,200 potentially vulnerable endpoints with this attack surface.
The freely available Microsoft Defender antivirus will detect the current publicly known post-exploitation attempts as and .
We鈥檝e got ~4,500 Exchange servers with our agent on them, and we鈥檙e actively looking into any red flags and potential signs of exploitation in these servers.聽
The 杏吧传媒 Managed Antivirus service will notify our ThreatOps team of any of the above Microsoft Defender detections and enable our team to begin to triage and investigate. At the moment, 杏吧传媒 has not seen any signs of exploitation or indicators of compromise on our partners' devices.
(Credit to this published by the GTSC Team)
Get insider access to 杏吧传媒 tradecraft, killer events, and the freshest blog updates.
