Vulnerable Exchange Servers Special Report #3

Attacks against potentially vulnerable Microsoft Exchange Servers are continuing became much easier to perform after working CVE-2021-26855 ProxyLogon Exploit exploit code was published online, moving incidents from APT to mainstream cybercrime activities. You can read more on the background of HAFNIUM and our previous Special Reports about potentially vulnerable Microsoft Exchange servers in our recent blog posts:

  1. HAFNIUM attributed Exchange victims (2021-02-26 to 2021-03-03, pre-patch release)
  2. Exchange Scanning #1 – mass exploitation (2021-03-09, post-patch release)
  3. Exchange Scanning #2 – confirmed web shells (2021-03-12, post-patch release)

This fourth one-off Special Report identifies additional potentially vulnerable Microsoft Exchange servers during the period 2021-03-13 to 2021-03-14, and is being shared outside of our normal free daily network reporting process with National CERT/CSIRTs and network owners and for maximum public benefit.

The blog entry announcing this report can be found here.

Shadowserver Special Reports are unlike all of our other standard free daily network reports. They do not cover a specific time period.

Instead, we send out Special Reports in situations where we are able to share one-time, high value datasets that we feel should be reported responsibly for maximum public benefit. Sometimes there are incidents when it would be useful to be able to notify potential victims about events or breaches that may have impacted them outside of the previous 24 hour period – for example during high profile events such as the Solarwinds Orion/SUNBURST supply chain or HAFNIUM/Microsoft Exchange Server mass breaches, when it may take a number of days for incident responders to conduct forensic investigations and analyzed data becomes available for sharing with potential victims. Although the events included in these Special Reports will fall outside of our usual 24 hour daily reporting window, we believe that there would still be significant benefit to our constituents in them receiving and hopefully acting on the retrospective data.

If you have missed a Special Report because you were NOT yet a subscriber at the time a report was pushed out, simply subscribe for your network now and specifically request all recent Shadowserver Special Reports – and we will regenerate them specifically for your network, at no cost.

Note that since the data than can shared during one-off reporting events is sometimes different from our more standard shared datasets, this report format is subject to change – primarily through the addition of new fields to better describe a particular dataset.

Fields

  • timestamp
    Timestamp when the IP was seen in UTC+0
  • ip
    IP of the affected device
  • asn
    As of the affected device
  • region
    Region of the affected device
  • city
    City of the affected device
  • hostname
    Hostname of the affected device (may be from revDNS)
  • naics
    North American Industry Classification System Code
  • sector
    Sector of the IP in question
  • tag
    Additional tags for more insight
  • public_source
    Source of the data
  • status
    Status of the affected IP, for example, vulnerable or likely vulnerable
  • detail
    Additional details on the event
  • account
    Affected account, if any

Sample

"timestamp","ip","asn","geo","region","city","hostname","naics","sector","tag","public_source","status","detail","account"
"2021-03-13 00:00:00","46.165.xxx.xxx",42652,"DE","RHEINLAND-PFALZ","KATZWEILER","012-132-165-046.ip-addr.inexio.net",,,"exchange",,"potentially vulnerable",,
"2021-03-13 00:00:00","23.84.xxx.xxx,20115,"US","MISSOURI","ST LOUIS","xxx.xxx.spectrum.com",517311,"Communications, Service Provider, and Hosting Service","exchange",,"potentially vulnerable",,
"2021-03-13 00:00:00","24.107.xxx.xxx",20115,"US","MISSOURI","FENTON","xxx.xxx.spectrum.com",517311,"Communications, Service Provider, and Hosting Service","exchange",,"potentially vulnerable",,
"2021-03-13 00:00:00","24.107.xxx.xxx",20115,"US","MISSOURI","ST LOUIS","xxx.xxx.spectrum.com",517311,"Communications, Service Provider, and Hosting Service","exchange",,"potentially vulnerable",,
"2021-03-13 00:00:00","24.158.xxx.xxx",20115,"US","MINNESOTA","DULUTH","xxx.xxx.spectrum.com",517311,"Communications, Service Provider, and Hosting Service","exchange",,"potentially vulnerable",,

Our 111 Report Types