On December 10, 2020, Orange Tsai, a Taiwanese security researcher, discovered a pre-authentication proxy vulnerability (CVE-2021-26855) in Microsoft Exchange Servers that allows a remote actor to bypass authentication and receive admin server privileges. On March 2, Microsoft released critical security updates for four crucial zero-day vulnerabilities discovered in Exchange Servers. Within one week, at least 30,000 U.S. organizations and hundreds of thousands of organizations worldwide had fallen victim to an automated campaign run by HAFNIUM that provides the attackers with remote control over the affected systems. In this session of SecPod Labs Intelligence Series, Veerendra GG and Pooja Shetty, will discuss: 1. What is Proxyogon Vulnerability and how can it impact your security 2. What made ProxyLogon so contagious and spread like a wildfire 3. Steps you can take to remediate the risk of being attacked

1. SecPod Labs Intelligence Series
PROXYLOGON: MS
EXCHANGE SERVER
VULNERABILITIES
Webcasts
27th May 2021
Pooja Shetty
Security Intelligence Team Lead
Jagsir
Director - Marketing
Veerendra
Director - Security Intelligence

2. 2
TODAY'S
AGENDA
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
What are MS Exchange Vulnerabilities?
Proxylogon Vulnerability and it’s impact on
businesses
Building Defence using SanerNow
Questions and Answers

3. 3
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Read and copy all emails
Install Backdoors
Install Ransomware, Keyloggers, etc
Install Web Shell, Reverse Shell, etc
Advanced social engineering attacks
MS Exchange Server Vulnerabilities' Real impact on email server compromise

4. 4
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
MS Exchange Server Vulnerability Stats - Last 5 Year
7
11
10
6
4
2
1
6
4
4 8
11
2
2
2
4
0
2
4
6
8
10
12
14
16
18
2016 2017 2018 2019 2020 2021
Medium Severity High Severity Critical Severity

5. 5
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
MS Exchange Server Vulnerability Stats - Severity Growth
4 4
8
11
2 2 2
4
0
2
4
6
8
10
12
2018 2019 2020 2021
High Severity Critical Severity

6. 6
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
DEVCORE
Started Research
on MS Exchange
01 Oct 2020
DEVCORE
Discovered First
Vulnerability -
CVE-2021-26855
10 Dec 2020
DEVCORE
Discovered
Second
Vulnerability -
CVE-2021-27065
30 Dec 2020
First Observer
Exploitation by
Volexity
03 Jan 2021
MSRC
Acknowledged
the Bugs (MSRC
Case: 62899 &
63835)
06 Jan 2021
Widespread
Scanning and
Possible
Exploitation of
Exchange
27 Feb 2021
Nation-state
Group HAFNIUM
Activity
Disclosed by
Microsoft
02 Mar 2021
MSRC Published
the Out of-Band-
Patch and
Advisory and
Acknowledged
DEVCORE
officially
02 Mar 2021
DEVCORE has
confirmed the in-
the-wild exploit
was the same
one reported to
MSRC
04 Mar 2021
First Public PoC
available
09 Mar 2021
MS Exchange Server - ProxyLogon Vulnerability Disclosure Timeline

7. 7
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Exchange Server Exploit Chain

8. 8
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Common themes being used in different attacks
Web Shells – Mainly implanted on victim machines to gain
access in future
Human Operated Ransomware –They exhibit extensive
knowledge of systems administration and common network
security misconfigurations, they adapt to what they discover in
a compromised network.
Stealing Credentials - Access to Exchange servers allowed
attackers to access and potentially steal credentials present on
the system.

9. 9
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Tactics Techniques and Procedures (TTPs) used in exploiting MS Exchange Vulnerabilities
DEJOCRYPT/DEARCRY RANSOMWARE
New ransomware campaign trying to exploit exchange vulnerabilities

10. 1
0
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Encrypts victim files and changes file headers to include string
‘DEARCRY’
The web shell then creates a batch file, chopper that allows
attackers to move laterally in, and steal credentials from the
compromised system.
Ransomware creates a windows service named msupdate and
is later removed when it finishes the encryption process.
TTPs of the Exchange Vulnerabilities
DEJOCRYPT/DEARCRY RANSOMWARE
New ransomware campaign trying to exploit exchange vulnerabilities

11. 1
1
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Continued…
Uses direct shell command execution against most other attacks that dropped web shells
Operators have previously employed exploits for SMB GHOST, ETERNAL BLUE vulnerabilities
Downloads Cobalt Strike DNS beacons
Cobalt Strike is a commercially-available penetration-testing tool
Sends out beacons to detect network flaws, and has historically been utilized by attackers to
exfiltrate data and deliver malware.
LEMON DUCK BOTNET

12. 1
2
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Continued…
LEMON DUCK BOTNET
Cryptocurrency miner and a malware loader

13. 1
3
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
TTPs of the Exchange Vulnerabilities
PYDOMER RANSOMWARE
Ransomware family previously seen attacking Pulse VPN vulnerabilities

14. 1
4
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
TTPs of the Exchange Vulnerabilities
PYDOMER RANSOMWARE
Human-operated ransomware – manually installed, extorts targets by threatening to release
stolen data
Non encryption extortion techniques are also being used
Web-shells have been spotted on around 1500 targets
Python script compiled into a windows executable encrypts the file using .demon extension

15. 1
5
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Building Defense: Complete response for exchange vulnerabilities
PERFORM FULL INVESTIGATION
Scan the system with security software, Install security updates available from Microsoft
Investigate for known IOC’s, IOA’s available from Microsoft
Look for unknown persistence items like unexpected services, scheduled tasks, startup items,
unknown RAT, Shadow IT Tools
Reset all admin credentials(randomize them), check for any new admin or password less
accounts
Windows Event ID 1102: The Audit Log Was Cleared
Practise principle of least privilege and mitigate lateral movement
Check email forwarding settings to identify if mailbox data is being exfiltrated

16. 1
6
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
Impact on Businesses
organizations have been breached through the
exploitation of these vulnerabilities
30,000-60,000 Government/Defense 17% Banking 11%
Manufacturing 14% Healthcare 8%
More attacks since Microsoft released a
patch on March 2nd
10 Times
Unpatched exchange servers across the
world vulnerable to exploitation as per Palo
Alto Networks as on March 8th
125,000
Hackers are already exploiting ProxyLogon vulnerabilities to
install DearCry ransomware on Exchange servers from US,
CA, AU
$50,000-$100,000

17. 1
7
Copyright © 2008 - 2021 SecPod Technologies - AUTHORISED USE ONLY
“Exchange server vulnerabilities are used as part of an attack chain; the initial attack requires the
ability to make an untrusted connection to Exchange server port 443. This can be protected against
by restricting untrusted connections, or by setting up a VPN to separate the Exchange server from
external access. Using this mitigation will only protect against the initial portion of the attack; other
portions of the chain can be triggered if an attacker already has access or can convince an
administrator to run a malicious file.”
- Microsoft
On March 15th, Microsoft released Exchange On-premises Mitigation Tool (EOMT.ps1) designed to
automate detection and patching of Exchange servers to help customers install security updates.

18. 18
Copyright © 2008 - 2020 SecPod Technologies - AUTHORISED USE ONLY
QUESTIONS?

19. KEEP YOUR ENDPOINTS
SECURE FROM
ATTACKERS!
TRY SANERNOW FREE.
For enquiries, contact us at:
Email: info@secpod.com | Tech Support: support@secpod.com
Phone: (+1) 918 625 3023 (US) | (+91) 80 4121 4020 (IN)
30-DAY UNLIMITED ACCESS ON 10 DEVICES
WWW.SECPOD.COM