4 ms·
There’s a vexing mystery surrounding the 0-day attacks on Exchange servers
- samizdis 6y agoA Bruce Schneier post on this yesterday [1] says: Somehow, the threat actor either knew that the exploits would soon become worthless or simply guessed that they would. So, in late February, the attacker changed strategy. Instead of simply exploiting targeted Exchange servers, the attackers stepped up their pace considerably by targeting tens of thousands of servers to install the web shell, an exploit that allows attackers to have remote access to a system. Microsoft then released the patch with very little warning on Mar. 2, at which point the attacker simply sought to compromise almost every vulnerable Exchange server on the Internet. The result? Virtually every vulnerable mail server received the web shell as a backdoor for further exploitation, making the patch effectively useless against the Chinese attackers; almost all of the vulnerable systems were exploited before they were patched. ... Now comes the criminal attacks. ... Expect the ransomware gangs to weaponize this attack within days. It makes sense (for some perverse definition of the word "sense") for the initial group/s to spill the beans to all and sundry when the game was up, if chaos/damage is an ancillary goal. [1] https://www.schneier.com/blog/archives/2021/03/more-on-the-chinese-zero-day-microsoft-exchange-hack.html https://www.schneier.com/blog/archives/2021/03/more-on-the-c...