Exim mail transfer agent (MTA) vulnerability being exploited

The vulnerability affects versions 4.87 to 4.91 of Exim. It is being exploited by at least two separate groups.

Security researchers have identified two different hacker groups exploiting this vulnerability. The attacks are similar in nature. They are downloading scripts from the attacker’s servers, which are being run on the target system. The scripts and locations have been observed to change over time, which indicates the groups are still developing their attacks.

One of the groups has used the vulnerability to download a shell script to mail servers that adds an SSH key to the root account. This campaign also features code for a self-spreading worm component that can spread this Exim exploit to other vulnerable Exim servers. The attackers also downloaded and installed a cryptocurrency miner on compromised servers.

If you’re running versions 4.87 to 4.91 (inclusive) of the Exim mail transfer agent (MTA) software, then you are affected by this vulnerability.

At the time of this advisory, CERT NZ are aware of the following  indicators of compromise:

• Look for any unfamiliar cronjobs in your crontab and remove them if they are not part of expected system operation
• Check your firewall and access logs for the following hostnames or IP addresses:
  • 173.212.214.137
  • https://an7kmd2wp4xo7hpr.tor2web.su
  • https://an7kmd2wp4xo7hpr.tor2web.io
  • https://an7kmd2wp4xo7hpr.onion.sh

Cybereason blog including additional indicators of compromise External Link

Make sure you are using the most recent version of Exim, 4.92.

Note that some Linux distributions have backported the fix to older versions, you will need to check your servers to ensure they have the necessary update applied.

Operating system controls such as SELinux or Apparmor could be used to mitigate the impact of an attack. When correctly implemented, these controls limit the resources that the Exim process has access to.