Zero Z Server Attack: The Latest Challenge for Cybersecurity Experts

Update [03/16/2021]: Microsoft released updated tools and investigation guidance to help IT Pros and incident response teams identify, remediate, defend against associated attacks: Guidance for responders: Investigating and remediating on-premises Exchange Server vulnerabilities.

Update [03/08/2021]: Microsoft continues to see multiple actors taking advantage of unpatched systems to attack organizations with on-premises Exchange Server. To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE: CSV format JSON format

zero z server attack

Download

Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. In the attacks observed, the threat actor used these vulnerabilities to access on-premises Exchange servers which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures.

Microsoft would like to thank our industry colleagues at Volexity and Dubex for reporting different parts of the attack chain and their collaboration in the investigation. Volexity has also published a blog post with their analysis. It is this level of proactive communication and intelligence sharing that allows the community to come together to get ahead of attacks before they spread and improve security for all.

Microsoft is providing the following details to help our customers understand the techniques used by HAFNIUM to exploit these vulnerabilities and enable more effective defense against any future attacks against unpatched systems.

CVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.

After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server. Web shells potentially allow attackers to steal data and perform additional malicious actions that lead to further compromise. One example of a web shell deployed by HAFNIUM, written in ASP, is below:

Our blog, Defending Exchange servers under attack, offers advice for improving defenses against Exchange server compromise. Customers can also find additional guidance about web shell attacks in our blog Web shell attacks continue to rise.

The below sections provide indicators of compromise (IOCs), detection guidance, and advanced hunting queries to help customers investigate this activity using Exchange server logs, Azure Sentinel, Microsoft Defender for Endpoint, and Microsoft 365 Defender. We encourage our customers to conduct investigations and implement proactive detections to identify possible prior campaigns and prevent future campaigns that may target their systems.

The Microsoft Exchange Server team has published a blog post on these new Security Updates providing a script to get a quick inventory of the patch-level status of on-premises Exchange servers and answer some basic questions around installation of these patches.

Many of the following detections are for post-breach techniques used by HAFNIUM. So while these help detect some of the specific current attacks that Microsoft has observed it remains very important to apply the recently released updates for CVE-2021-26855, CVE-2021-26857, CVE-2021-27065 and CVE-2021-26858.

Microsoft Tuesday issued instructions and a one-click tool to small businesses with on-premises Exchange servers to patch the vulnerability first disclosed by the company March 2, and which criminals have been using to spy on victims' communications as well as gain access to other parts of their networks.

The tool, dubbed (with the usual Microsoft knack of catchy monikers), "Microsoft Exchange On-Premises Mitigation Tool," is aimed at customers that don't have dedicated IT personnel or are even "unfamiliar," Microsoft said, with the patching and update process. The tool works on Exchange 2013, 2016, and 2019, the currently supported editions of the server software. (Exchange 2013 will be supported until April 2023, while the other two editions will be supported until October 2025.)

Microsoft's free tool for small businesses mitigates against attacks on Exchange Server using one of the several vulnerabilities the Redmond, Wash. developer patched March 2. (Click image to enlarge it.)

The tool does several things, notably configuring Exchange Server to institute a mitigation for the CVE-2021-26855 vulnerability (one of four now being exploited by cyber criminals). The tool also runs a malware scan using "Microsoft Safety Scan," a free utility that both sniffs out exploits and attempts to reverse any changes made by attackers. (The scanner, which can also be manually downloaded from here, is live for the following 10 days. Users can trigger it for additional scans at any time after the mitigation through that stretch.)

This was not the first automated script Microsoft has offered customers to mitigate against attacks based on the Exchange Server bugs patched on March 2. Three days after that, Microsoft posted links to multiple mitigation tools, including "ExchangeMitigations.ps1," a PowerShell script that tackled several of the patched vulnerabilities, including CVE-2021-26855, which was also addressed by the newer On-Premises Mitigation Tool.

All data is ultimately accessed over network infrastructure. Networking controls can provide critical controls to enhance visibility and help prevent attackers from moving laterally across the network. Segment networks (and do deeper in-network micro-segmentation) and deploy real-time threat protection, end-to-end encryption, monitoring, and analytics.

US executive order 14028, Improving the Nation's Cyber Security, directs federal agencies on advancing security measures that drastically reduce the risk of successful cyberattacks against the federal government's digital infrastructure. On January 26, 2022, the Office of Management and Budget (OMB) released the federal Zero Trust strategy in memorandum 22-09, in support of EO 14028.

The fact that China Chopper is a tool used by certain APT groups and the fact that China Chopper was specifically used to attack the vulnerable Microsoft services leads us to believe that additional APT groups are targeting these vulnerabilities.

Stuxnet specifically targets programmable logic controllers (PLCs), which allow the automation of electromechanical processes such as those used to control machinery and industrial processes including gas centrifuges for separating nuclear material. Exploiting four zero-day flaws,[7] Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software. Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart.[8] Stuxnet's design and architecture are not domain-specific and it could be tailored as a platform for attacking modern SCADA and PLC systems (e.g., in factory assembly lines or power plants), most of which are in Europe, Japan, and the United States.[9] Stuxnet reportedly ruined almost one-fifth of Iran's nuclear centrifuges.[10] Targeting industrial control systems, the worm infected over 200,000 computers and caused 1,000 machines to physically degrade.[11]

Stuxnet has three modules: a worm that executes all routines related to the main payload of the attack; a link file that automatically executes the propagated copies of the worm; and a rootkit component responsible for hiding all malicious files and processes, to prevent detection of Stuxnet.[12] It is typically introduced to the target environment via an infected USB flash drive, thus crossing any air gap. The worm then propagates across the network, scanning for Siemens Step7 software on computers controlling a PLC. In the absence of either criterion, Stuxnet becomes dormant inside the computer. If both the conditions are fulfilled, Stuxnet introduces the infected rootkit onto the PLC and Step7 software, modifying the code and giving unexpected commands to the PLC while returning a loop of normal operation system values back to the users.[13][14]

Different variants of Stuxnet targeted five Iranian organizations,[23] with the probable target widely suspected to be uranium enrichment infrastructure in Iran;[22][24][25] Symantec noted in August 2010 that 60% of the infected computers worldwide were in Iran.[26] Siemens stated that the worm has caused no damage to its customers,[27] but the Iran nuclear program, which uses embargoed Siemens equipment procured secretly, has been damaged by Stuxnet.[28][29] Kaspersky Lab concluded that the sophisticated attack could only have been conducted "with nation-state support."[30] F-Secure's chief researcher Mikko Hyppönen, when asked if possible nation-state support was involved, agreed "That's what it would look like, yes."[31]

On 25 December 2012, an Iranian semi-official news agency announced there was a cyberattack by Stuxnet, this time on the industries in the southern area of the country. The malware targeted a power plant and some other industries in Hormozgan province in recent months.[36]

Kaspersky Lab experts at first estimated that Stuxnet started spreading around March or April 2010,[44] but the first variant of the worm appeared in June 2009.[21] On 15 July 2010, the day the worm's existence became widely known, a distributed denial-of-service attack was made on the servers for two leading mailing lists on industrial-systems security. This attack, from an unknown source but likely related to Stuxnet, disabled one of the lists, thereby interrupting an important source of information for power plants and factories.[39] On the other hand, researchers at Symantec have uncovered a version of the Stuxnet computer virus that was used to attack Iran's nuclear program in November 2007, being developed as early as 2005, when Iran was still setting up its uranium enrichment facility.[45] 2ff7e9595c