Microsoft Says Chinese Hackers Targeted Groups Through Server Software

A China-linked cyberespionage group remotely looted email inboxes using newly discovered flaws in Microsoft’s email server software, the company and outside researchers said on Tuesday – an example of how commonly used programs can be exploited to broadcast a large online network.

GET FOX BUSINESS ON THE ROAD BY CLICKING HERE

In a blog post, Microsoft said the hacking campaign used four previously undetected vulnerabilities in different versions of the software and was the work of a group he dubbed HAFNIUM, which he described as an entity sponsored by the operating state in China.

In a separate blog post, cybersecurity firm Volexity said that in January it saw hackers use one of the vulnerabilities to remotely steal “the entire contents of multiple user mailboxes.” All they needed to know were the details of the Exchange server and the account they wanted to loot his emails, Volexity said.

The Chinese Embassy in Washington did not immediately return messages seeking comment. Beijing routinely denies engaging in cyber espionage despite a drumbeat of allegations from the United States and others.

U.S. CYBER AGENCY SAYS SOLARWINDS HACKERS ‘IMPACTING’ STATE AND LOCAL GOVERNMENTS

Before Microsoft’s announcement, the increasingly aggressive hacker movements started to gain the attention of the cybersecurity community.

Mike McLellan, intelligence director for Secureworks at Dell Technologies Inc., said ahead of Microsoft’s announcement that he noticed a sudden spike in activity affecting Exchange servers overnight Sunday, with around ten customers affected in his company.

Microsoft’s near-ubiquitous suite of products have come under intense scrutiny since the hack of SolarWinds, the Texas-based software company that has served as a springboard for several intrusions into government and the private sector. In other cases, hackers took advantage of the way customers had configured their Microsoft services to compromise their targets or dive deeper into affected networks.

LARGE HACKER ATTACK PUT CYBER EXPERTS WORLDWIDE TO DEFEND NETWORKS

Hackers who attacked SolarWinds also violated Microsoft itself, accessing and downloading source code – including items from Exchange, email, and the company’s calendar product.

McLellan said that at the moment, the hacking activity he had seen appeared to be focused on seeding malware and setting the stage for a potentially deeper intrusion rather than aggressively moving across all networks. right now.

Teleprinter	security	Latest	Change	Change%
MSFT	MICROSOFT CORP.	233.87	-3.07	-1.30%

“We haven’t seen any follow-up activity yet,” he said. “We are going to find a large number of affected businesses but a smaller number of actually operated businesses.”

CLICK HERE TO LEARN MORE ABOUT FOX BUSINESS

Microsoft said the targets included infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and non-government groups.

(Reporting by Raphael Satter and Christopher Bing; Editing by Dan Grebler)