Microsoft Exchange ProxyShell is being exploited to mine crypto once again

Cryptocurrencies
Migliori Bitcoin wallet (Image credit: Shutterstock / Wit Olszewksi)

Hackers are using known ProxyShell vulnerabilities to install cryptocurrency miners on vulnerable Microsoft Exchange servers, researchers have claimed.

Cybersecurity experts from Morphisec observed unidentified attackers using ProxyShell (an umbrella term for multiple vulnerabilities that, when chained together, allow for remote code execution) to install XMRig on Microsoft Exchange servers.

XMRig is one of the most popular cryptocurrency mining malware variants, generating the Monero (XMR) cryptocurrency for attackers. Monero is a popular choice among cybercriminals because of its privacy features and the fact that it’s almost impossible to trace.

Hiding in plain sight

Morphisec says that the vulnerabilities used in this campaign are CVE-2021-34473 and CVE-2021-34523. Both of these were discovered, and patched, two years ago. Therefore, the best way to protect against these attacks is to apply the fix to vulnerable endpoints

The attackers have also put in extra effort to make sure they remain hidden for as long as possible, the researchers said. 

Once the miner is set up, it will create a firewall rule, applied to all Windows Firewall profiles, to block all outgoing traffic. That way, the researchers continued, the IT teams and other defenders won’t be notified of the breach in the system. 

Furthermore, the malware will wait at least 30 seconds between starting the mining process and creating the firewall rule, to evade triggering alarms from security tools that monitor process runtime behavior. 

Cryptocurrency miners won’t destroy a computer, but as they take up almost all of the computing power, will render the device practically useless. What’s more, they could rake up enormous electricity bills for the computers’ owners. 

Morphisec also said that vulnerable Microsoft Exchange server owners shouldn’t take the attack lightly, as after making their way into the network, there’s nothing stopping the attackers from deploying any other form of malware.

Via: BleepingComputer

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Flag of the People's Republic of China overlaid with a technological network of wires and circuits.
One of the biggest flaws exploited by Salt Typhoon hackers has had a patch available for years
A person at a laptop with a cybersecure lock symbol floating above it.
Cybercrime gang targets victims with "triple threat" attacks
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
Red padlock open on electric circuits network dark red background
CrowdStrike warns of fake job offer scam that is actually just malware
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
A person holding out their hand with a digital AI symbol.
This ransomware gang is using SSH tunnels to target VMware appliances
Latest in Software & Services
TinEye website
I like this reverse image search service the most
A person in a wheelchair working at a computer.
Here’s a free way to find long lost relatives and friends
A white woman with long brown hair in a ponytail looks down at her computer in a distressed manner. She is holding her forehead with one hand and a credit card with the other
This people search finder covers all the bases, but it's not perfect
That's Them home page
Is That's Them worth it? My honest review
woman listening to computer
AWS vs Azure: choosing the right platform to maximize your company's investment
A person at a desktop computer working on spreadsheet tables.
Trello vs Jira: which project management solution is best for you?
Latest in News
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon just experimented with renaming Echo speakers to Alexa Devices, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does
Nintendo Virtual Game Card
Nintendo reveals the new Virtual Game Card feature, an easier way to manage your digital Switch games
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA