MS Exchange Attacks: Block Anonymous VPN Services (and these IOCs)

Until two weeks ago, thousands of Microsoft Exchange servers were under attack unknown to anyone. Since Microsoft and other researchers uncovered this severe cyber offensive against various U.S. institutions, organizations have been scrambling to patch the vulnerabilities used in the attack, understand the extent of potential damage, and ensure protection for next time (and there will be a next time). In this blog post, we'll explain how to do exactly that.

As we wrote in our earlier post, Hafnium, the Chinese APT group behind the attacks, used a set of four previously unknown Exchange Server vulnerabilities to access victim mailboxes, and perform remote code execution (RCE). The attacks played out as follows:

• The attackers first used the vulnerabilities or stolen passwords to gain access to the server.

• Then, they created a web shell, allowing them remote control of the compromised server.

• At that point they had full control, with the ability to steal mailbox contents and data from the victim organization. They could also use this access as a beachhead and then move laterally within the organizations' infrastructure.

Blocking Anonymous VPN Services

Threat actors, including Hafnium, have been observed using anonymous VPN services as part of the attacks leveraging MS Exchange 0-day vulnerabilities. Yes, anonymous VPN is that thing many people use to trick Netflix into letting them access a different country’s content library. Not surprisingly, cyber criminals are also in on the deal with this simple-to-use technology that proves to be so effective in disguising large scale attacks. Blacklisting the IPs of these anonymous services protects users from suspicious and potentially malicious traffic, and could have protected the victims of this attack. ThreatSTOP customers are protected by our Anonymous VPN Services Exit – IPs target, which blocks traffic from anonymous VPN providers.

Using Threat Intelligence to block attacks

Once an attack becomes known and researchers start delving in to the attack methods and infrastructure, numerous indicators of compromise (IOCs) are published, either publicly or through paid subscriptions and partnerships. The problem, therefore, is not insufficient data. The challenge is aggregating and implementing it all. Applying blocklists that include all the latest IOCs for a given attack dramatically strengthens your first line of defense, and simply eliminates attacks attempting to use those IOCs. We automatically aggregate high-quality threat intelligence from over 800 sources, updated minute-by-minute with all the newest IOCs as they are uncovered.

Following the reveal of the MS Exchange attacks, our security team has built URL, Domain and IP lists for these attacks. Much of the data has been included in these lists thanks to Blue Team Blog, as well as other threat intelligence sources and security blogs. If you are already a ThreatSTOP customer, you are automatically protected from this attack infrastructure as well as other threats like this. Not a ThreatSTOP user yet? Add these IOCs to your blocklists to ensure you are protected from now on from these adversaries and campaigns.

Ready to try ThreatSTOP in your network ? Want an expert-led demo to see how it works?

URLs:

Domains:

IP Addresses: