HAFNIUM and Exchange Vulnerabilities – What To Do Now…
There has been lots of noise in the press and on social media about the HAFNIUM threat actors and the current vulnerability that has been detected in all current versions of Exchange on premise.
If you haven’t read up on the attack and the risks you can do so here;
https://www.kaspersky.co.uk/blog/exchange-vulnerabilities/22385/
These articles have been leaving a lot of IT managers and CTO running around looking for solutions. They need a way to quickly patch up the servers and cover over a hole that has been there since at least last November, when as far as the first reported case of an attack using this vulnerability. However, what do you need to be doing next?
We all know that Microsoft issued patches on a non-standard update to Windows or a (out-of-band) update. For those out of the know, this means this Hafnium vulnerability is bad! Microsoft rarely break their patch cycle but when they do as with the SMB vulnerabilities with WannaCry. When they do it means you need to be act fast.
By the time these latest OoB updates where released, Microsoft made it clear that these attacks where already happening, which means for some of you who are readying this article thinking you are safe because you ran the patch, you may not be.
The four most dangerous vulnerabilities already being exploited allow attacks to pull off a three stage attack on compromised systems.
The attack chain is simple;
- First, access a compromised Exchange server (one missing the patch) this can even be an Exchange Management point for Office 365, it doesn’t need to be a full running system.
- Then they create a Web shell for remote server access
- They then use this to harvest data from the network and systems associated with this Exchange server, essential using it like an open front door.
So how do you protect against the Hafnium threat?
This is where you need to be looking at having a product in place as your antivirus/antimalware which uses EDR or XDR technology and has up to date behaviour and exploit prevention and detection.
Watch out for the following detections
- Exploit.Win32.CVE-2021-26857.gen
- HEUR:Exploit.Win32.CVE-2021-26857.a
- HEUR:Trojan.ASP.Webshell.gen
- HEUR:Backdoor.ASP.WebShell.gen
- UDS:DangerousObject.Multi.Generic
So what should you do next?
As Microsoft has already released an update to fix all these vulnerabilities, we strongly recommend updating Exchange Servers as soon as possible, Microsoft have even gone as far as releasing a quick install roll up which should work for most Exchange servers. For more complex deployments like DAG’s, then Planet IT can support you with this process.
You then need to focus on your defence strategy on detection lateral movements and data exfiltration to the internet. For this we recommend that you pay special attention to outgoing traffic to detect cybercriminal connections.
As always you should ensure that you are backing-up regularly and make sure you can quickly access it in an emergency, if you have questions on this then Michael Davey – [email protected] and his Back Up Services team will be more than happy to help.
Make sure you have an Endpoint Detection and Response product in place. If you don’t reach out to your Planet IT account manager who can provide you with details of what is available and works with your security landscape.
Finally make sure you are using a reliable endpoint security solution such as Kaspersky or Sophos that has included in it Exploit Prevention, Behaviour Detection, a Remediation engine. It would also be beneficial to ensure that your product has a Vulnerability and Patch Management capabilities.
If you would like to discuss with myself or any of the cyber security team at Planet IT about how you can better protect you business, should that be with new technology, strategies or even better back ups you can reach us using the contact details below;
Contact me at – LinkedIn Message James Dell or Email : [email protected]
Call 01235 433900 or Email : [email protected]
