CISA Issues Emergency Directive on In-the-Wild Microsoft Exchange Flaws

Following Microsoft’s release of out-of-band patches to address multiple zero-day flaws in on-premises versions of Microsoft Exchange Server, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive warning of “active exploitation” of the vulnerabilities.

The alert comes on the heels of Microsoft’s disclosure that China-based hackers were exploiting unknown software bugs in Exchange server to steal sensitive data from select targets, marking the second time in four months that the U.S. has scrambled to address a widespread hacking campaign believed to be the work of foreign threat actors.

While the company mainly attributed the campaign to a threat group called HAFNIUM, Slovakian cybersecurity firm ESET said it found evidence of CVE-2021-26855 being actively exploited in the wild by several cyber espionage groups, including LuckyMouse, Tick, and Calypso targeting servers located in the U.S., Europe, Asia, and the Middle East.

Researchers at Huntress Labs have also sounded the alarm about mass exploitation of Exchange servers, noting that over 350 web shells have been discovered across approximately 2,000 vulnerable servers.

“Among the vulnerable servers, we also found over 350 web shells — some targets may have more than one web shell, potentially indicating automated deployment or multiple uncoordinated actors,” Huntress senior security researcher John Hammond said. “These endpoints do have antivirus or EDR solutions installed, but this has seemingly slipped past a majority of preventative security products.”

The latest development indicates a much larger spread that extends beyond the “limited and targeted” attack reported by Microsoft earlier this week.

It’s not clear if any U.S. government agencies have been breached in the campaign, but the CISA directive underscores the urgency of the threat.

Strongly urging organizations to apply the patches as soon as possible, the agency cited the “likelihood of widespread exploitation of the vulnerabilities after public disclosure and the risk that federal government services to the American public could be degraded.”