[SGVLUG] From KnowBe4 - [Heads Up] The Chinese Have Likely Hacked Your Exchange Email Server

[Jan Foote]

Hi, 

I thought this article with his recommendations could be of help to some of you.  

Thank you, 
Jan
(323) 259-0608 Calls Only, Texts Do Not Go Through
 

   ----- Forwarded Message ----- From: Stu Sjouwerman <ssjouwerman at knowbe4.com>To: "Sent: Saturday, March 6, 2021, 8:19:08 AM PSTSubject: [Heads Up] The Chinese Have Likely Hacked Your Exchange Email Server
    Take action now to patch your systems  
|  
|  
| 
|   |

  |

  |
|  
|  
| 
|   |

  |
| 
|    |

  |
| 
| 
Hi 


What if Chinese state-sponsored hackers have owned your OWA using several brand-new zero-day vulns? Or worse, Eastern European Ransomware Criminals?

On March 2, Microsoft released emergency security updates to plug four security holes in Exchange Server versions 2013 through 2019 that hackers were actively using to siphon email communications from Internet-facing systems running Exchange.

The Chinese hacking group thought to be responsible has seized control over “hundreds of thousands” of Microsoft Exchange Servers worldwide, at least 30,000 in America — with each victim system representing approximately one organization that uses Exchange to process email.

The truth is, if you are running an OWA server exposed to the internet, assume you have been compromised between 02/26-03/03 and you are now in incident response mode until proven otherwise.

An adversary owning your email systems, being able to see all threads, and injecting a reply containing a malicious link into an existing thread between trusted parties is a worrying thought. You gotta train your users for events like this! And of course patch those systems immediately.


It was all over the press, but Brian Krebs covers it the best as usual, and he has a quick thing you can check to see if you are compromised:
https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/

Here is the Microsoft blog about this urgent issue, where they have an update that multiple bad actors are attacking unpatched systems.
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  |

  |
| 
|   |    |   |

  |
| 
|   |

  |
| 
|   |   |   |

  |
| 
|   |

  |
| 
| 
Warm regards,

Stu Sjouwerman
Founder and CEO
KnowBe4, Inc.


  |

  |

  |

  |
|  
| 
| 
|  |  |  |  |  |  |

  |

  |
| 
| 
KnowBe4, Inc.

#161 INC. 500 2019 America’s Fastest Growing Companies

33 N Garden Ave Suite 1200 Clearwater, Florida 33755 USA



You received this email because you are subscribed to KnowBe4 Operational Alert Emails from KnowBe4 

Update your to choose the types of emails you receive.
  |

  |
|  |

  |

  |

   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://sgvlug.net/pipermail/sgvlug/attachments/20210306/8091b7b4/attachment-0001.htm>