WebSetNet

Technology News

Hackers are now installing Ransomware using Hafnium Exchange Server exploit

by

The original Hafnium server hacks were likely espionage-motivated, but now the predicted second wave driven clearly by criminal intent has started.

Microsoft has confirmed hackers are attacking unpatched Exchange servers and installing the Dearcry ransomware on some occasions.

The Dearcry ransomware then attempts to prevent Windows Update from running and installing a fix for the vulnerability. The next step is encrypting your files and then delivering a ransom note on your desktop.

While Microsoft has released a patch more than 10 days ago, Palo Alto Networks noted that 80,000 older servers are still unpatched.

“I’ve never seen security patch rates this high for any system, much less one as widely deployed as Microsoft Exchange,” said Matt Kraning, Chief Technology Officer, Cortex at Palo Alto Networks. “Still, we urge organizations running all versions of Exchange to assume they were compromised before they patched their systems, because we know attackers were exploiting these zero-day vulnerabilities in the wild for at least two months before Microsoft released the patches on March 2.”

via BleepingComputer

Related posts:

  1. The Week in Ransomware – February 2nd 2018 – TOR Sites Stealing Ransom Payments & GandCrab
  2. Turn On Built-in Ransomware Protection In Windows 10
  3. Trend Micro Ransomware File Decryptor will decrypt files encrypted by Ransomware
  4. McAfee Ransomware Recover (Mr2) can help in decrypting files encrypted by Ransomware
  5. Microsoft December 2020 Patch Tuesday fixes 58 vulnerabilities
  6. Sophisticated new Android malware marks the latest evolution of mobile ransomware
  7. Microsoft Windows Security Updates September 2020 overview
  8. Thanos Ransomware adds Windows MBR locker that fails every time
  9. RanSim Ransomware Simulator will tell you if your computer is protected
  10. RanSim to Test How Vulnerable Your Computer is Against Ransomware Attack