The number of users attacked by exploits targeting vulnerabilities in Microsoft Exchange Servers, blocked by Kaspersky products, grew by 170% in August from 7,342 to 19,839 users.
According to Kaspersky experts, this staggering growth is linked to the increasing number of attacks that attempt to exploit previously disclosed vulnerabilities in the product, and the fact that users do not patch vulnerable software right away, thereby widening the potential attack surface.
Vulnerabilities inside MS Exchange Server caused a lot of chaos this year. On March 2, 2021, the public learnt about ‘in-the-wild’ exploitations of zero-day vulnerabilities inside Microsoft Exchange Server, which were then exploited in a wave of attacks on organisations worldwide.
Later in the year, Microsoft also patched a series of the so-called ProxyShell vulnerabilities – CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207.
Together these vulnerabilities represent a critical threat and enable an actor to bypass authentication and execute code as a privileged user.
Even though the patches for these vulnerabilities were released a while ago, cybercriminals did not hesitate to exploit them, with 74,274 Kaspersky users encountering exploits for MS Exchange vulnerabilities in the past six months.
Furthermore, as Cybersecurity and Infrastructure Security Agency (CISA) in the USA warned on August 21, ProxyShell vulnerabilities are now actively exploited by cybercriminals in a recent wave of attacks.
In its advisory, released on August 26, Microsoft explained that an Exchange server is vulnerable if it is not running a Cumulative Update (CU) with at least the May Security Update (SU).
Unique users that encountered attacks on MS Exchange, March-August 2021
According to Kaspersky telemetry, in the last week of the European summer, over 1,700 users were attacked using ProxyShell exploits daily, leading to the number of users attacked in August 2021 to grow by 170% compared to July 2021.
This reflects the large scale problem these vulnerabilities represent, if left unpatched.
“The fact that these vulnerabilities are being actively exploited comes as no surprise – quite often, 1-day vulnerabilities – the ones that have already been disclosed and have patches released by developers – represent an even bigger threat as they are known to a wider array of cybercriminals who try their luck in penetrating any network they can get their hands on.
This active growth of attacks demonstrates once again why it is so essential to patch vulnerabilities as soon as possible to prevent the networks from being compromised. We strongly recommend following Microsoft’s recent advisory to mitigate any wider risks,” comments Evgeny Lopatin, security researcher, Kaspersky.
Kaspersky products protect against exploits that abuse ProxyShell vulnerabilities with Behaviour Detection and Exploit Prevention components and detect exploitation with the following verdicts:
- PDM:Exploit.Win32.Generic
- HEUR:Exploit.Win32.ProxyShell.
- HEUR:Exploit.*.CVE-2021-26855.