A 'significant' number of cyberattacks targeting vulnerable Microsoft Exchange servers are attempted every single day, warn researchers at F-Secure - who say it's critical to apply the patches immediately.
By Danny Palmer | March 22, 2021 -- 15:50 GMT (08:50 PDT) | Topic: Security
Why old cybersecurity vulnerabilities are still a big problem
There are still thousands of cyberattacks targeting zero-day security vulnerabilities in Microsoft Exchange Server every single day as cyber criminals attempt to target organisations that have yet to apply the security patches released to mitigate them, according to a tech security company.
Microsoft released critical updates to secure Microsoft Exchange Servers against the four vulnerabilities on March 2 with organisations urged to apply them as a matter of urgency to prevent cyberattacks to their email servers.
But weeks later, many organisations are yet to apply the critical updates for Microsoft Exchange Server and cyber attackers are taking advantage to gain access to servers while it remains possible.
SEE: Network security policy (TechRepublic Premium)
And cyber criminals are doing just that, with security researchers at F-Secure identifying tens of thousands of attacks targeting organisations around the world that are still running vulnerable Microsoft Exchange Server every day. According to F-Secure analytics, only about half of the Exchange servers visible on the internet have applied the Microsoft patches for these vulnerabilities.
"Tens of thousands of servers have been hacked around the world. They're being hacked faster than we can count. Globally, this is a disaster in the making," said Antti Laatikainen, senior security consultant at F-Secure.
The fear is that an attack that successfully compromises a Microsoft Exchange Server not only gains access to sensitive information that's core to how businesses are run, but could also open the door for additional attacks – including ransomware campaigns.
In order to avoid falling victim to cyber attackers exploiting the Microsoft Exchange vulnerabilities, it's recommended that organisations apply the critical updates as quickly as possible, because the longer the patches aren't applied, the more time cyber criminals will have to potentially exploit the vulnerabilities as part of an attack.
Even if organisations have already applied the relevant security updates, there's no guarantee they were not compromised by malicious hackers before the patches were applied – so it's important to analyse the network to examine if it has already been accessed by cyber criminals.
When it isn't possible to install the critical Microsoft Exchange updates, the UK's National Cyber Security Centre (NCSC) recommends that untrusted connections to Exchange server port 443 should be blocked, while Exchange should also be configured so it can only be accessed remotely via a VPN.
In another step to protect against Exchange Server vulnerabilities, Microsoft has implemented an automatic mitigation tool within within Defender Antivirus that helps prevent unpatched servers falling victim to attacks.
SEE: Check to see if you're vulnerable to Microsoft Exchange Server zero-days using this tool
Tens of thousands of organisations around the world are known to have had their email servers compromised in attacks targeting Microsoft Exchange. Microsoft have attributed the campaign to a state-sponsored advanced persistent threat (APT) hacking group working out of China, dubbed Hafnium.
However, once knowledge of the vulnerabilities became public following the release of the patch, other state-sponsored and cyber-criminal hacking groups have attempted to target Microsoft Exchange servers that have yet to have patches applied.
It's recommended that organisations take measures to mitigate attacks as soon as possible.
"There are a ton of things they can do manually to prevent a full disaster. I just encourage them to do them immediately," said Laatikainen.