Microsoft Exchange Server data breach (2021)

From International cyber law: interactive toolkit
Jump to navigation Jump to search
Date First breach observed on 3 January 2021[1]
Suspected actor More than ten advanced persistent threat (APT) groups were involved.[2] These include Hafnium, which is alleged by Microsoft to be a Chinese state-sponsored group,[3] Tick (also known as Bronze Butler), LuckyMouse (also known as APT27 and Emissary Panda), Calypso, the Winnti Group (also known as BARIUM and APT41), Tonto Team (also known as CactusPete), Mikroceen (also known as Vicious Panda), Websiic, DLTMiner,[4] and at least one previously unknown group.[5] With the exception of DLTMiner, which has been linked to crypto-mining, the APT groups have all been linked to cyber espionage.[2]

On 19 July 2021, the US, joined by several other Western States, NATO and the European Union, stated that it attributed the cyber operations ‘with a high degree of confidence’ to malicious cyber actors affiliated with China’s Ministry of State Security.[6]

China has repeatedly denied any involvement.[7]

Target Between tens of thousands to more than 250,000 victims worldwide, particularly small businesses and governments, as of 6 March 2021.[8] Prominent targets have included the European Banking Authority,[9] the Norwegian Parliament,[10] and Chile’s Commission for the Financial Market.[11] The Taiwanese multinational corporation Acer was also targeted.[12]
Target systems On-premises Microsoft Exchange servers
Method Four zero-day exploits of vulnerabilities in Microsoft Exchange were utilised to gain initial access to servers, after which web shell backdoors, such as China Chopper,[13] were deployed in order to preserve long-term access to the compromised servers.[14] At least one web shell had the capability to run commands and upload, delete, and view files.[15] Post-compromise tools such as Covenant, Nishang and PowerCat were deployed, enabling remote access.[16]

In some cases, the ransomware known as DearCry was subsequently installed on vulnerable on-premises Microsoft Exchange servers.[17] The REvil ransomware was also deployed on other vulnerable systems,[12] as was the Black KingDom ransomware.[18]

Crypto-mining malware, such as Lemon Duck[19] and the Monero-mining component of Prometei,[20] was deployed in some systems.

A leading theory, proposed by investigators from Microsoft and from the US government, suggests that “[t]he suspected Chinese hackers mined troves of personal information acquired beforehand to carry out the attack.”[21]

It has also been theorised by cybersecurity firm SentinelOne that the large number of threat actors involved is explicable by the provision by a Chinese entity of the exploits to multiple hacking groups.[22]

Purpose Data exfiltration,[3] crypto-mining,[23] and ransom-seeking[17]
Result Web shells were installed on more than 5,000 unique servers in over 115 countries.[3] The effects on various targeted entities have been quite diverse. For example, the European Banking Authority’s servers were compromised, but because it precautionarily took its email systems offline,[24] no data was exfiltrated from its systems.[25] In contrast, data was exfiltrated from the Norwegian Parliament, although the full extent of damage is unknown.[10] Even though it had been “affected” by the incident,[11] the Chilean financial regulator, the Commission for the Financial Market, did not find the presence of any ransomware.[26]

Acer reportedly suffered data exfiltration and was hit with a demand to pay a ransom of $50 million.[12] Acer, however, did not comment on the incident, nor on the size of the ransom demanded.[27]

Aftermath The US Federal Bureau of Investigation, the Australian Cyber Security Centre and the UK National Cyber Security Centre each coordinated national responses against the exploits.[28]

Microsoft patched the vulnerabilities[29] and the Microsoft Defender antivirus was updated to automatically mitigate them.[30] However, these patches and mitigations do not remove existing infections, such as web shells and backdoors that have already been installed.[31]

Microsoft Defender was also updated to detect and remove the DearCry ransomware.[17]

Analysed in Scenario 02: Cyber espionage against government departments

Scenario 09: Economic cyber espionage

Scenario 14: Ransomware campaign

Collected by: Darryl Chan

  1. ↑ Josh Grunzweig, Matthew Meltzer, Sean Koessel, Steven Adair, Thomas Lancaster, ‘Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities’, Volexity (08 March 2021)
  2. ↑ 2.0 2.1 ‘Number of APT groups exploiting the latest Exchange vulnerabilities grows, with thousands of email servers under siege, ESET discovers’, ESET (10 March 2021)
  3. ↑ 3.0 3.1 3.2 Tom Burt, ‘New nation-state cyberattacks’, Microsoft (02 March 2021)
  4. ↑ Matthieu Faou, Mathieu Tartare, Thomas Dupuy, ‘Exchange servers under siege from at least 10 APT groups’, ESET (10 March 2021)
  5. ↑ Sergiu Gatlan, ‘More hacking groups join Microsoft Exchange attack frenzy’, Bleeping Computer (10 March 2021)
  6. ↑ United States, ‘The United States, Joined by Allies and Partners, Attributes Malicious Cyber Activity and Irresponsible State Behavior to the People’s Republic of China’ (19 July 2021).
  7. ↑ ‘Foreign Ministry Spokesperson Wang Wenbin's Regular Press Conference on March 3, 2021‘, Ministry of Foreign Affairs of the People’s Republic of China’ (3 March 2021); Eric Tucker, ‘Microsoft Exchange hack caused by China, US and allies say’ AP News (20 July 2021) (reporting a statement by a spokesperson for the Chinese Embassy in Washington, Liu Pengyu, that the ‘U.S. has repeatedly made groundless attacks and malicious smear against China on cybersecurity. Now this is just another old trick, with nothing new in it.’).
  8. ↑ Robert McMillan, Dustin Volz, ‘China-Linked Hack Hits Tens of Thousands of U.S. Microsoft Customers’, Wall Street Journal (06 March 2021)
  9. ↑ ‘Cyber-attack on the European Banking Authority’, European Banking Authority (07 March 2021)
  10. ↑ 10.0 10.1 ‘New cyberattack on the Storting’, Stortinget (11 March 2021)
  11. ↑ 11.0 11.1 'CMF informa sobre incidente de ciberseguridad', Comisión para el Mercado Financiero (14 March 2021)
  12. ↑ 12.0 12.1 12.2 Lawrence Abrams, ‘Computer giant Acer hit by $50 million ransomware attack’, Bleeping Computer (19 March 2021)
  13. ↑ Charlie Osborne, ‘Hafnium’s China Chopper: a ‘slick’ and tiny web shell for creating server backdoors’, ZDNet (15 March 2021)
  14. ↑ ‘HAFNIUM targeting Exchange Servers with 0-day exploits’, Microsoft (16 March 2021)
  15. ↑ Matt Bromiley, Chris DiGiamo, Andrew Thompson, Robert Wallace, ‘Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities’, FireEye (04 March 2021)
  16. ↑ Charlie Osborne, ‘Microsoft Exchange zero-day vulnerabilities exploited in attacks against US local governments’, ZDNet (05 March 2021)
  17. ↑ 17.0 17.1 17.2 Sabina Weston, ‘Microsoft warns of ransomware attacks as Exchange hack escalates’, ITPro (12 March 2021)
  18. ↑ Mark Loman, ‘Black Kingdom ransomware begins appearing on Exchange servers’, Sophos (23 March 2021)
  19. ↑ Rajesh Nataraj, ‘New Lemon Duck variants exploiting Microsoft Exchange Server’, Sophos (07 May 2021)
  20. ↑ Dan Kobialka, ‘Hackers Use Prometei Botnet to Attack Microsoft Exchange Users’, MSSP Alert (22 April 2021)
  21. ↑ Dustin Volz, Robert McMillan, ‘Suspected China Hack of Microsoft Shows Signs of Prior Reconnaissance’, Wall Street Journal (07 April 2021)
  22. ↑ Dan Goodin, ‘There’s a vexing mystery surrounding the 0-day attacks on Exchange servers’, Ars Technica (11 March 2021)
  23. ↑ Charlie Osborne, ‘Lemon Duck hacking group adopts Microsoft Exchange Server vulnerabilities in new attacks’, ZDNet (10 May 2021)
  24. ↑ ‘European Banking Authority hit by Microsoft Exchange hack’, BBC News (08 March 2021)
  25. ↑ ‘Cyber-attack on the European Banking Authority – UPDATE 3’, European Banking Authority (09 March 2021)
  26. ↑ 'CMF actualiza información sobre incidente de ciberseguridad', Comisión para el Mercado Financiero (15 March 2021)
  27. ↑ Michael Novinson, ‘REvil Ransomware Targets Acer’s Microsoft Exchange Server: Source’, CRN (19 March 2021)
  28. ↑ Charlie Osborne, ‘Everything you need to know about the Microsoft Exchange Server hack’, ZDNet (19 April 2021)
  29. ↑ MSRC Team, ‘One-Click Microsoft Exchange On-Premises Mitigation Tool – March 2021’, Microsoft Security Response Center (15 March 2021)
  30. ↑ Microsoft 365 Defender Team, ‘Automatic on-premises Exchange Server mitigation now in Microsoft Defender Antivirus’, Microsoft (18 March 2021).
  31. ↑ Charlie Osborne, ‘Microsoft: 92% of vulnerable Exchange servers are now patched, mitigated’, MSN (24 March 2021)
Retrieved from "https://cyberlaw.ccdcoe.org/wiki/Microsoft_Exchange_Server_data_breach_(2021)?oldid=2577"