• Menu
  • Skip to main content
  • Skip to primary sidebar

All Tech News

Latest Technology News

Use This One-Click Mitigation Tool from Microsoft to Prevent Exchange Attacks

You are here: Home / Cyber Security News / Use This One-Click Mitigation Tool from Microsoft to Prevent Exchange Attacks

Microsoft on Monday introduced a one-click on mitigation application that applies all the vital countermeasures to safe susceptible environments in opposition to the ongoing popular ProxyLogon Exchange Server cyberattacks.

Known as Exchange On-premises Mitigation Instrument (EOMT), the PowerShell-based script serves to mitigate from existing recognized attacks applying CVE-2021-26855, scan the Exchange Server making use of the Microsoft Protection Scanner for any deployed web shells, and endeavor to remediate the detected compromises.

“This new software is created as an interim mitigation for shoppers who are unfamiliar with the patch/update process or who have not still applied the on-premises Exchange security update,” Microsoft stated.

The advancement comes in the wake of indiscriminate attacks against unpatched Exchange Servers across the environment by extra than 10 sophisticated persistent threat actors — most of the government-backed cyberespionage groups — to plant backdoors, coin miners, and ransomware, with the launch of proof-of-strategy (PoC) fueling the hacking spree even even more.

Based mostly on telemetry from RiskIQ, 317,269 out of 400,000 on-premises Trade Servers globally have been patched as of March 12, with the U.S., Germany, Wonderful Britain, France, and Italy main the nations with susceptible servers.

Furthermore, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has current its advice to element as lots of as seven variants of the China Chopper web shell that are being leveraged by destructive actors.

Using up just 4 kilobytes, the web shell has been a preferred put up-exploitation resource of decision for cyber attackers for virtually a ten years.

While the breadth of the intrusions is being assessed, Microsoft is also reportedly investigating how the “restricted and focused” attacks it detected in early January picked up steam to swiftly morph into a common mass exploitation campaign, forcing it to release the security fixes a 7 days prior to it was owing.

The Wall Street Journal on Friday reported that investigators are focused on whether or not a Microsoft lover, with whom the enterprise shared information and facts about the vulnerabilities through its Microsoft Active Protections Software (MAPP), both accidentally or purposefully leaked it to other groups.

It is also staying claimed that some equipment employed in the “second wave” of assaults in direction of the stop of February are similar to evidence-of-strategy attack code that Microsoft shared with antivirus organizations and other security companions on February 23, increasing the possibility that threat actors may perhaps have gotten their palms on non-public disclosure that Microsoft shared with its security companions.

The other idea is that the threat actors independently identified the similar set of vulnerabilities, which ended up then exploited to stealthily conduct reconnaissance of goal networks and steal mailboxes right before ramping up the attacks after the hackers figured out Microsoft was readying a patch.

“This is the second time in the very last 4 months that country-state actors have engaged in cyberattacks with the probable to affect firms and corporations of all dimensions,” Microsoft said. “Though this began as a country-condition attack, the vulnerabilities are being exploited by other criminal organizations, such as new ransomware assaults, with the opportunity for other malicious routines.”

Observed this report appealing? Adhere to THN on Facebook, Twitter  and LinkedIn to read much more distinctive written content we post.

Some parts of this article are sourced from:
thehackernews.com

Previous Post: « Sony's new 4K TVs with 'cognitive' CPUs are rolling out, VRR will follow later
Next Post: Microsoft outage affects Teams, Azure and Xbox Live »

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Recent Posts

  • Critical JetBrains TeamCity Flaw Could Expose Source Code and Build Pipelines to Attackers
  • Ukrainian Military Targeted in Phishing Campaign Leveraging Drone Manuals
  • Watch the Webinar — AI vs. AI: Harnessing AI Defenses Against AI-Powered Risks
  • Are You Willing to Pay the High Cost of Compromised Credentials?
  • From Watering Hole to Spyware: EvilBamboo Targets Tibetans, Uyghurs, and Taiwanese

Copyright © 2023 · AllTech.News, All Rights Reserved.