The fallout continues from the China-based Hafnium attacks on Microsoft in a 0-day email server hack. As of March 6th an estimated 30,000 Microsoft clients were assumed compromised. Unfortunately, this threat is also very real to the United States government on all levels.

Over the weekend the number of known victims was continuing to increase. Now it appears over 60,000 impacted companies and institutions. And it appears there will be more. 

Microsoft issued a concise statement. “We are working closely with the CISA, other government agencies, and security companies, to ensure we are providing the best possible guidance and mitigation for our customers."

“The best protection is to apply updates as soon as possible across all impacted systems. We continue to help customers by providing additional investigation and mitigation guidance. Impacted customers should contact support teams for additional help and resources.”  The firm declined to comment about the severity of the attack. They also aren’t talking about why it took them so long to respond. 

What Happened?

Security experts agree that the Chinese government-backed Hafnium hacking group is responsible. In the mass-hack,  hundreds of thousands of Microsoft Exchange Server systems got compromised.  And the exploitation opened up the backdoor Trojan horse program.

Danish cybersecurity company Dubex reported on their blog, Please Leave an Exploit After the Beep, that victims they reviewed in January had a “web shell” backdoor installed through the “unifying messaging” module. This module is a core component on the  Exchange network that organizes and stores emails, calendars, voicemail, and faxes in the Contacts compartment of Microsoft users’ mailboxes.

Two months to Respond?

Software giant Microsoft admitted it was attacked in “early January.”  Apparently, the company didn’t understand how dangerous the attacks were. The firm did not disclose the breach until March 2nd when they posted details on-site and issued its first set of patches.

The Cybersecurity expert blog, KrebsonSecurity, tracks-back the first report of the hack-attack that came on Jan. 5, from security testing firm DEVCORE, also known as “Orange Tsai.” The cyber company reported two of the four flaws that Microsoft disclosed and introduced patches for on March 2nd.

Cybersecurity company  Volexity based in Reston, Va.claims they found evidence of attacks on January 6th. After more investigation, they informed Microsoft on February 2nd. Volexity claims they can see attack traffic going back to January 3rd.

Multiple Exploitations?

The MIT Technology Review reports that Hafnium is not the only threat. Security experts claim there may now be at least four other hacking groups actively exploiting the Exchange Server flaws. 

White House press secretary Jen Psaki announced that it was “an active threat,” and pointed to the Department of Homeland Security’s emergency directive from March 3rd.

Department of Homeland Security’s cybersecurity agency sent out March 3rd. White House national security adviser Jake Sullivan warned about it as well. Additionally, so did former Cybersecurity and Infrastructure Security Agency director Christopher Krebs and the White House National Security Council.

Hackers reportedly installed malware that allows direct entry and re-entry into the servers.

“We are undertaking a whole of government response to assess and address the impact,” reads part of an email from a White House official, according to Bloomberg.

What’s the Damage?

On March 2nd Microsoft made patches available for the local Microsoft Exchange Server for 2010 to 2019. Global security is still analyzing the scope of the damage. 

Uncertainty remains about how long the vulnerabilities were out there. Support for the server stopped in 2010.  Microsoft provided a “freebie” patch to users. Some security researchers are wondering if these vulnerabilities have been undetected in the Microsoft Exchange Server code base for over a decade.

There are plenty of questions about Microsoft’s slow response. If they would have notified users sooner would that have mitigated some of the threat? It’s doubtful, just like in the recent SolarWinds hack, that there will be any real answers. Either way, it’s clear that cybersecurity will be the big issue trending throughout 2021.