UnknownPublished 9 Mar 2021Updated 10 Mar 2021

March 2021 Exchange Server Security Updates for older Cumulative Updates of Exchange Server

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Impact

For European organizations, the impact of these Exchange Server vulnerabilities could be substantial. Exchange Server is widely used across Europe for corporate email and collaboration, making it a high-value target. Exploitation could lead to unauthorized access to sensitive communications, data leakage, disruption of email services, and potential lateral movement within networks. Critical sectors such as finance, government, healthcare, and energy could face operational disruptions and reputational damage. The absence of patches for older cumulative updates means organizations that have not upgraded remain vulnerable, increasing the risk of targeted attacks. Additionally, the ability to deliver payloads and drop artifacts could facilitate persistent threats and advanced attacks. The impact extends beyond confidentiality to integrity and availability, potentially causing widespread business interruption and compliance violations under regulations like GDPR.

Defensive guidance

European organizations should immediately verify the version and cumulative update level of their Exchange Server deployments. They must prioritize upgrading to the latest supported cumulative updates and apply all available security patches from Microsoft. For systems that cannot be upgraded promptly, implement compensating controls such as network segmentation, strict access controls, and enhanced monitoring for suspicious activity related to payload delivery and artifact creation. Employ endpoint detection and response (EDR) tools to detect anomalous behavior on Exchange servers. Regularly audit Exchange server logs for unusual access patterns or unauthorized changes. Educate IT staff on the importance of patch management and maintaining supported software versions. Establish incident response plans specific to Exchange Server compromise scenarios. Finally, consider threat hunting exercises focused on indicators of compromise related to Exchange Server vulnerabilities.

Indicators of compromise

Hashes 11

To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.

511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1
b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0
4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea
811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d
65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5
4b3039cf227c611c45d2242d1228a121
0ba9a76f55aaa495670d74d21850d0155ff5d6a5
b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0
5544ba9ad1b56101b5d52b5270421d4a
fc6f5ce56166d9b4516ba207f3a653b722e1a8df

File 31

%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\errorPages.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\fatal-erro.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\log.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\logg.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\logout.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\one.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\one1.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\shel.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\shel2.aspx
%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\shel90.aspx

Link 3

https://techcommunity.microsoft.com/t5/exchange-team-blog/march-2021-exchange-server-security-updates-for-older-cumulative/ba-p/2192020
https://www.virustotal.com/gui/file/b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0/detection/f-b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0-1615293798To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
https://www.virustotal.com/gui/file/511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1/detection/f-511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1-1615284167To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.

Text 3

March 2021 Exchange Server Security Updates for older Cumulative Updates of Exchange Server To help customers more quickly protect their environments in light of the March 2021 Exchange Server Security Updates, Microsoft is producing an additional series of security updates (SUs) that can be applied to some older (and unsupported) Cumulative Updates (CUs). The availability of these updates does not mean that you don’t have to keep your environment current. This is intended only as a temporary measure to help you protect vulnerable machines right now. You still need to update to the latest supported CU and then apply the applicable SUs. If you are already mid-update to a later CU, you should continue with that update.
32/59To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
18/58To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.

Datetime 2

2021-03-09T12:43:18+00:00
2021-03-09T10:02:47+00:00

Community reviews

Loading reviews…