Starting February 27, 2021, Rapid7 has observed a notable increase in the exploitation of Microsoft Exchange through existing detections in InsightIDR’s Attacker Behavior Analytics (ABA). The Managed Detection and Response (MDR) identified multiple, related compromises in the past 72 hours. In most cases, the attacker is uploading an “eval” webshell, commonly referred to as a “chopper” or “China chopper”. With this foothold, the attacker would then upload and execute tools, often for the purpose of stealing credentials. Further investigative efforts have identified overlap in attacker techniques and infrastructure.
At close to midnight UTC on February 27, 2021, Managed Detection and Response SOC analysts began observing alerts for the following ABA detections in InsightIDR:
- Attacker Tool – China Chopper Webshell Executing Commands
- Attacker Technique – ProcDump Used Against LSASS
Upon further inspection of Enhanced Endpoint Telemetry data produced by InsightAgent, Rapid7 analysts identified that attackers had successfully compromised several systems and noted that they were all on-premise Microsoft Exchange servers with web services accessible to the public Internet. Exposing web services to the public internet is a common practice for customers with on-premise instances of Microsoft Exchange to provide their users with email services over the web through Outlook Web Access (OWA).
Using Project Sonar, Rapid7’s Labs team was able to identify how target-rich an environment attackers have to work with: Nearly 170,000 servers vulnerable to a different recent Exchange CVE (for which proof-of-concept exploit code is readily available) were exposed to the public internet.
With the compromise identified, our team of Customer Advisors alerted our customers to this activity. Meanwhile, our analysts quickly began performing deeper inspection of the logs uploaded to InsightIDR along with collecting additional forensic information directly from the compromised endpoints. Within a very short period of time, our analysts were able to identify how the attackers were executing commands, where they were coming from, and what tools they were using. This information allowed Rapid7 to provide proactive, actionable steps to our customers to thwart the attack . Additionally, our analysts worked jointly with our Threat Intelligence and Detection Engineering (TIDE) team to review the collected data for the purpose of immediately developing and deploying additional detections for customers.
Three days later, on March 2, 2021, Microsoft acknowledged and released information on the exploitation of 0-day vulnerabilities in Microsoft Exchange by an actor they refer to as “hafnium.” They also released patches for Microsoft Exchange 2013, 2016 and 2019 (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, as well as others).
Despite this vulnerability being unknown to the public, Rapid7 was able to identify the attackers presence on systems to help defend against the use of these 0-day exploits with our Attacker Behavior Analytics library.
Rapid7 recommends that everyone running Microsoft Exchange apply these patches immediately as they are being exploited in the wild by a sophisticated adversary.
Technical Analysis of Attacker Activity
- Automated scanning to discover vulnerable Exchange servers from the following DigitalOcean IP addresses:
2. Analysis of Internet Information Services (IIS) logs shows a POST request is then made from the scanning DigitalOcean IP to multiple paths and files:
- IIS Path ex: /aspnet_client/system_web/TInpB9PE.aspx
- File system path ex: C:inetpubwwwrootaspnet_clientsystem_webTInpB9PE.aspx
- File system path: C:inetpubwwwrootaspnet_clientaspx_iistart.aspx
- File system path: C:inetpubwwwrootaspnet_clientaspx_client.aspx
- File system path: C:inetpubwwwrootaspnet_clientaspnet.aspx
In some cases, additional dynamic link libraries (DLLs) and compiled aspx files are created shortly after the webshells are first interacted with via POST requests in the following locations:
- C:WindowsMicrosoft.NETFramework64<version>Temporary ASP.NET Filesroot
- C:WindowsMicrosoft.NETFramework64<version>Temporary ASP.NET Filesowa
3. Next, a command executes, attempting to delete the “Administrator” from the “Exchange Organization administrators” group:
- cmd /c cd /d C:\inetpub\wwwroot\aspnet_client\system_web&net group “Exchange Organization administrators” administrator /del /domain&echo [S]&cd&echo [E]
4. With the command executed, and the webshell successfully uploaded, interaction with the webshell will begin from a different IP.
- We have monitored interaction from 45.77.252[.]175
5. Following the POST request, multiple commands are executed on the asset:
a. Lsass.exe dumping using procdump64.exe and C:Tempupdate.exe
- cmd /c cd /d C:\root&procdump64.exe -accepteula -ma lsass.exe lsass.dmp&echo [S]&cd&echo [E]
b. Reconnaissance commands:
Indicators Of Compromise (IOCs)
If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.