Four zero-day vulnerabilities in Microsoft Exchange Servers have been linked to more than 30,000 cyber attacks taking place in the week following their discovery. Prior to the flaws being revealed, Chinese nation-state threat actors had already exploited them to infiltrate numerous companies and access their data. Even since a patch was released, many other threat groups have found success using the vulnerabilities (including in ransomware attacks). This rapidly drove up the number of daily attacks between 11 and 17 of March 2021: from 700 to 7,200. Compounding the problem are proof of concept (PoC) exploit codes published on GitHub, which cybercriminals quickly shared on forums. The widespread use of the servers and distribution of PoCs will likely lead to persistent targeting of unpatched Exchange Servers in the short-term future (one to three months).
Digital Shadows
Threat Intelligence and Digital Risk Protection Resources
