Cyber criminals and nation-state actors believed to be affiliated with the Chinese government continue to exploit recently announced vulnerabilities in Microsoft Exchange on-premises products, posing a serious risk to federal agencies and private organizations, the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency said this week in a joint advisory.

The advisory provides technical indicators of compromise for which recipients are advised to scan their networks and immediately implement the prescribed patches.

“Successful exploitation of these vulnerabilities allows an attacker to access victims’ Exchange Servers, enabling them to gain persistent system access and control of an enterprise network,” the advisory notes. “It has the potential to affect tens of thousands of systems in the United States and provides adversaries with access to networks containing valuable research, technology, personally identifiable information (PII), and other sensitive information from entities in multiple U.S. sectors. FBI and CISA assess that adversaries will continue to exploit this vulnerability to compromise networks and steal information, encrypt data for ransom, or even execute a destructive attack. Adversaries may also sell access to compromised networks on the dark web.”

John Riggi, AHA senior advisor for cybersecurity and risk, said, “This is now a cyber race. The adversaries are acutely aware that they have been exposed and that their covert access to a reported 60,000 organizations worldwide may end soon as patches are implemented. They will no doubt attempt to exfiltrate as much data as possible, conduct ransomware attacks or burrow deeper into the networks before their access ends. It is imperative that affected organizations implement the prescribed patches as soon as possible. Breach reports or request for assistance from the government should be directed to the FBI’s 24/7 CyWatch at 855-292-3937.”

For further information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org.

Related News Articles

Headline
The FBI today released an alert on the ransomware variant Darkside, which this month infected a critical infrastructure company in the United States. The…
Blog
Are you aware that cyber adversaries target the health care sector the most of all critical infrastructure sectors? Hospitals and health systems in particular…
Headline
During the pandemic, there has been a dramatic increase in cyberattacks targeting hospitals and health systems, including disruptive ransomware attacks that…
Headline
The FBI and Department of Homeland Security today released recommendations to help organizations secure their networks from ongoing cyber threats from the…
Headline
The Russian Foreign Intelligence Service (SVR) continues to exploit five publicly known cyber vulnerabilities, the National Security Agency, Cybersecurity and…
Blog
A panel of rural health care experts and other health care leaders assembled by the AHA and the Black Coalition Against COVID-19 convened April 21 at 7 p.m. ET…