Alert: Microsoft Exchange Vulnerabilities Used To Deploy Ransomware

On March 11, 2021, Microsoft acknowledged that the recently disclosed Microsoft Exchange vulnerabilities were being used to facilitate ransomware attacks.

What is being exploited?

The four vulnerabilities - known as vulnerabilities CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065 - have been exploited by attackers to compromise systems beyond the Exchange server.

How are the vulnerabilities being exploited?

Successful exploitation of the vulnerabilities provides attackers access to Microsoft Exchange servers, and then allows them to gain persistent system access and ultimately control of a network. The Exchange ProxyLogon exploit has been used to facilitate ransomware attacks with the DearCry variant, and will likely continue to be used to compromise networks, steal sensitive information, and encrypt data for ransom.