{"id":26729,"date":"2022-09-30T01:59:57","date_gmt":"2022-09-29T23:59:57","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=26729"},"modified":"2022-11-16T19:55:08","modified_gmt":"2022-11-16T18:55:08","slug":"exchange-server-werden-ber-0-day-exploit-angegriffen-29-sept-2022","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2022\/09\/30\/exchange-server-werden-ber-0-day-exploit-angegriffen-29-sept-2022\/","title":{"rendered":"Exchange Server servers attacked via 0-day exploit (Sept. 29, 2022)"},"content":{"rendered":"

\"Exchange[German<\/a>]There are reports that a new zero-day exists in Microsoft Exchange that is being actively exploited in the wild. Security researchers confirm that some installations – including a honeypot – are already infected. Details about the zero-day are not yet available. Here's an overview of what I know so far and what, if anything, can be done to detect attacks.<\/p>\n

<\/p>\n

\"\"I came across the facts a few minutes ago via Twitter<\/a>. Security researcher Kevin Beaumont warns of a potential threat to Exchange servers from a zero-day exploit. At the same time, an email from blog reader Marco D. arrived (thanks for that), informing me about the issue as follows:<\/p>\n

I just discovered this on Twitter<\/a>, a zero day exploit for Exchange:<\/p><\/blockquote>\n

\"Exchange<\/a><\/p>\n

I don't know the linked Vietnamese site, but the content seemed conclusive, especially since the ZDI entries exist as well.<\/p><\/blockquote>\n

First report from GTSC<\/h2>\n

The article WARNING: NEW ATTACK CAMPAIGN UTILIZED A NEW 0-DAY RCE VULNERABILITY ON MICROSOFT EXCHANGE SERVER\u00a0 by an author from Vietnam seems to be the first source describing the problem. The security team at Vietnamese cybersecurity firm GTSC discovered in early August 2022 that a critical infrastructure had been attacked as part of security monitoring and incident response activities. Microsoft Exchange servers of the organizations in question were affected.<\/p>\n

During the investigation, GTSC's Blue Team experts determined that the attack exploited an undisclosed Exchange vulnerability, i.e., a 0-day vulnerability. The team immediately created a countermeasure plan to stop the attacks. At the same time, the GTSC Red teams began examining and debugging Exchange's decompiled code to find the vulnerability and exploit code.<\/p>\n

A previously unknown vulnerability (zero-day) was found that proved to be critical enough to allow attackers to perform remote code execution (RCE) on the compromised target system. GTSC immediately reported the vulnerability to the Zero Day Initiative (ZDI) to work with Microsoft. The goal was to create a patch as quickly as possible. The Zero Day Initiative (ZDI) verified and confirmed 2 flaws with CVSS scores 8.8 and 6.3 related to the exploit.<\/p>\n