FBI, CISA detail risks posed by potential on-premises Microsoft Exchange compromise

Cyber criminals and nation-state actors believed to be affiliated with the Chinese government continue to exploit recently announced vulnerabilities in Microsoft Exchange on-premises products, posing a serious risk to federal agencies and private organizations, the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency said this week in a joint advisory.

The advisory provides technical indicators of compromise for which recipients are advised to scan their networks and immediately implement the prescribed patches.

“Successful exploitation of these vulnerabilities allows an attacker to access victims’ Exchange Servers, enabling them to gain persistent system access and control of an enterprise network,” the advisory notes. “It has the potential to affect tens of thousands of systems in the United States and provides adversaries with access to networks containing valuable research, technology, personally identifiable information (PII), and other sensitive information from entities in multiple U.S. sectors. FBI and CISA assess that adversaries will continue to exploit this vulnerability to compromise networks and steal information, encrypt data for ransom, or even execute a destructive attack. Adversaries may also sell access to compromised networks on the dark web.”

John Riggi, AHA senior advisor for cybersecurity and risk, said, “This is now a cyber race. The adversaries are acutely aware that they have been exposed and that their covert access to a reported 60,000 organizations worldwide may end soon as patches are implemented. They will no doubt attempt to exfiltrate as much data as possible, conduct ransomware attacks or burrow deeper into the networks before their access ends. It is imperative that affected organizations implement the prescribed patches as soon as possible. Breach reports or request for assistance from the government should be directed to the FBI’s 24/7 CyWatch at 855-292-3937.”

For further information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org.