The Microsoft Exchange attack leveraging multiple zero-days has by some accounts been one of the most wide-spread and potentially damaging hacks in history, orchestrated by a group Microsoft has named HAFNIUM. Malicious network activity related to the attack was first detected in January but the full nature and extent of the attack was publicly disclosed only on March 2nd. Active exploitation started around February 26th, primarily targeting U.S. entities. 

Virtually any enterprise running Exchange Server on-premises is vulnerable to this sophisticated attack leveraging four zero-day exploits chained together. Once the attackers have breached the Exchange Server they can use that server access to move laterally, exfiltrate company data or compromise the target network in other ways.

There are a range of signatures that defenders can look for to determine if their organization has been compromised by the Hafnium group (that Microsoft has publicly attributed as a state-sponsored group based in China). For ThreatSTOP customers, the IOCs (IPs and Domains) have been added in February so that any attempted exfiltration or C2 communication will trigger an alert and blocking action. 

Here's a partial list of Hafnium-related IP subnets we are blocking and alerting on:

5.254.43[.]18/32
80.92.205[.]81/32
103.77.192.[2]19/32
104.140.114.[1]10/32
104.250.191.[1]10/32
108.61.246[.]56/32
149.28.14.[1]63/32
157.230.221.[1]98/32
167.99.168.[2]51/32
185.250.151[.]72/32
192.81.208.[1]69/32
203.160.69[.]66/32
211.56.98.[1]46/32

Here's an example of the result when searching on an IP address associated with Hafnium:

Hafnium IP activity 2

We also provide a target, Anonymous VPN Services Exit - IPs, that customers can use to block access to their network from  those services. We also recommend applying the TOR targets that will block communication with TOR exit nodes. The Hafnium group has been observed using such anonymized services.

If you'd like assistance to optimize policy management or guidance on log analysis, contact our customer success team.

 

Ready to try ThreatSTOP in your network? Want an expert-led demo to see how it works?    

Get a Demo

 

Further reading:

https://blueteamblog.com/microsoft-exchange-zero-days-mitigations-and-detections 

https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ 

https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/