FOLLOW US

The Chinese government-backed group Hafnium launched a sophisticated hack-attack on the Microsoft email software. Microsoft first disclosed the attack on March 1st on its site. They explained that the zero-day malware infected the Exchange email infrastructure using exploitation techniques. Millions of businesses worldwide use the system. The breach resulted in a massive cybersecurity crisis.

The European Banking Authority confirmed on Sunday that it too had been attacked. Unfortunately, customers' personal data held on the  Microsoft server in emails may have been compromised, they warned. Others injured by the malware infection include banks, utility companies, nursing homes, and businesses.

There are up to 250,000 global targets with at least 30,000 US victims. Researchers believe that during the last phases of the attack, the perpetrators escalated and automated the process. This allowed them to scoop-up tens of thousands of new victims across the globe in just a few days.

This includes companies of all sizes, as well as, a number of governmental entities and financial institutions. The hacker group continues its effort to infect as many businesses as possible before the potential victims are able to secure their networks and computer systems.

The attackers have been able to cast a wide net for victims since they infected most of the infrastructure system before Microsoft’s cybersecurity experts could shut down the hack.

Multiple Security Updates Released for Exchange Server 

Microsoft last updated their security and technical information on March 5th. They reported details of the attack and provided security patches.

Huntress Labs, a Maryland-based firm that monitors cybersecurity wrote a Post-Exploitation Analysis on Friday.

“If you use on-prem Microsoft Exchange Servers, you might want to assume you’ve been hit. We recommend you not only patch immediately but externally validate the patch and hunt for the presence of these web shells and other indicators of compromise (see the technical details below). Trusting the dashboard is simply not enough.”

Huntress gave additional details and also provided security patches.

From One Cybersecurity Crisis to the Next

The attack comes on the heels of the SolarWinds attack by suspected Russian hackers which breached at least nine federal agencies and over 100 companies. The group infected updates from IT management software maker SolarWinds, LLC.

Washington is still dealing with the fallout of SolarWinds. Additionally, Washington is preparing its response to the Russian intrusions. A planned series of clandestine actions across Russian networks will send a message to Vladimir Putin, the New York Times reported. There may also be economic sanctions. 

“We are undertaking a whole of government response to assess and address the impact,” a White House official wrote in an email on Saturday. “This is an active threat still developing and we urge network operators to take it very seriously.”

Hopefully, Washington can now turn its attention to the Chinese threat actors. With hundreds of Chinese spies arrested in the US over the last few years and a large number of Chinese government-backed hacker groups operating internationally, the possible cybersecurity threats and attacks can be overwhelming.