Microsoft Exchange vulnerabilities being exploited with ransomware

Updated at: 2:45pm on Monday 15 March:

CERT NZ is aware of international reporting indicating that threat actors are using the vulnerabilities identified in Exchange to deploy ransomware on vulnerable servers and networks. There are also reports of attackers scanning for previously deployed webshells to leverage earlier exploitation. CERT NZ recommends that servers should be investigated for signs of compromise and credentials used on the affected servers should be changed. 

-------

Updated at: 1.30pm on Friday 5 March: 

CERT NZ is aware that widespread exploitation activity has occurred as a result of these vulnerabilities. Patching should be carried out immediately.

CERT NZ understands that some of the exploitation activity occurred during February 2021, and may have begun earlier. As this activity predates the release of the security update from Microsoft, we urge all organisations running Microsoft Exchange servers to also investigate their servers, specifically to identify the Indicators of Compromise provided on the Microsoft Security Blog, linked in the advisory below.  For organisations that are not able to conduct this level of investigation internally, CERT NZ recommends engaging professional services for additional support.

--------

Microsoft has released an urgent update for Exchange Server in response to servers being actively attacked by a sophisticated threat actor. Organisations running Microsoft Exchange servers, particularly those directly exposed to the internet, are urged to patch these servers immediately. Exchange Online is not affected.