{"id":4277,"date":"2021-03-22T07:44:29","date_gmt":"2021-03-22T12:44:29","guid":{"rendered":"https:\/\/www.stratospherenetworks.com\/blog\/?p=4277"},"modified":"2021-03-19T16:07:55","modified_gmt":"2021-03-19T21:07:55","slug":"microsoft-exchange-server-exploits-faq-how-to-protect-your-business","status":"publish","type":"post","link":"https:\/\/www.stratospherenetworks.com\/blog\/microsoft-exchange-server-exploits-faq-how-to-protect-your-business\/","title":{"rendered":"Microsoft Exchange Server Exploits FAQ: How to Protect Your Business"},"content":{"rendered":"

\"AnEarlier this month, Microsoft announced<\/a> that malicious actors were leveraging zero-day exploits to infiltrate on-premises versions of Microsoft Exchange Server. If your company utilizes an Exchange server that hackers could potentially breach via these vulnerabilities, here\u2019s everything you should know about the ongoing attacks, what you can do to fix weak points in your server and how to identify indicators of compromise (IOCs).<\/p>\n

Who\u2019s responsible for the cyberattacks on Exchange servers and when did they start?<\/h2>\n

Microsoft attributed the initial attacks to HAFNIUM, a state-sponsored group based in China, according to a blog post published March 2<\/a>. However, in a more recent post<\/a>, the supplier noted that criminal groups other than HAFNIUM had begun taking advantage of the server vulnerabilities to launch their own cyberattacks, including onslaughts of ransomware<\/a>.<\/p>\n

The security firm Volexity first identified<\/a> suspicious activity on some of their clients\u2019 Exchange servers in January 2021. Microsoft credits both Volexity and Dubex for sounding the alarm on the attacks and aiding with the investigation.<\/p>\n

What are the Microsoft Exchange Server vulnerabilities hackers are exploiting?<\/h2>\n

HAFNIUM used the following vulnerabilities to gain access to Exchange servers, according to Microsoft.<\/p>\n