Multiple cyber threats lurking compromised systems: Microsoft

Facing multiple hacking attempts on its business email servers worldwide Microsoft has reiterated the warning that patching a system does not necessarily remove the access of the attackerThe key vulnerabilities in the Microsoft business email servers have left cyber security experts flummoxed as this freeforall attack opportunity is now being exploited by vast numbers of criminal gangs statebacked threat actors and opportunistic script kiddies researchers at FSecure said last weekAlthough many onpremises Microsoft Exchange servers have been patched New investigation has found that multiple threats are still lurking on alreadycompromised systemsAccording to Microsoft 365 Defender Threat Intelligence Team many of the compromised systems have not yet received a secondary action such as humanoperated ransomware attacks or data exfiltration indicating attackers could be establishing and keeping their access for potential later actionsThese actions might involve performing followon attacks via persistence on Exchange servers they have already compromised or using credentials and data stolen during these attacks to compromise networks through other entry vectors the tech giant said in its latest updateTaiwanese electronics and computer maker Acer has already been hit by a ransomware attack where the hackers are demanding 50 million the largest known ransom to dateAccording to Bleeping Computer hackers have accessed Acer documents that include financial spreadsheets bank balances and bank communications compromising its network via a Microsoft Exchange server vulnerabilityEarlier reports have claimed that five different hacking groups including Chinabacked hacking group called Hafnium are exploiting vulnerabilities in the business email servers of MicrosoftAccording to Microsoft attackers who included the exploit in their toolkits whether through modifying public proof of concept exploits or their own research capitalised on their window of opportunity to gain access to as many systems as they couldSome attackers were advanced enough to remove other attackers from the systems and use multiple persistence points to maintain access to a network the company notedMicrosoft said that it is important to note that with some postcompromise techniques attackers may gain highly privileged persistent access but many of the impactful subsequent attacker activities can be mitigated by practicing the principle of least privilege and mitigating lateral movementAccording to the FSecure report countries currently seeing the most detections in descending order are Italy Germany France the UK the US Belgium Kuwait Sweden the Netherlands and TaiwanThis story has been sourced from a third party syndicated feed agencies Midday accepts no responsibility or liability for its dependability trustworthiness reliability and data of the text Midday managementmiddaycom reserves the sole right to alter delete or remove without notice the content in its absolute discretion for any reason whatsoever