HAFNIUM Group Microsoft Targeting Exchange Servers

On March 2nd, 2021, Microsoft released seven out-of-band security patches for Microsoft Exchange Server to address zero-day flaws that have been used in limited targeted attacks. Microsoft attributes the campaign to a new state-sponsored APT group. According to Microsoft Threat Intelligence Center (MSTIC), a new Chinese state-sponsored threat actor named HAFNIUM, actively exploits four previously undisclosed security flaws in Exchange Server. The vulnerabilities being exploited are CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. According to Microsoft and Volexity, attackers exploited these vulnerabilities as part of a complex attack consisting of several parts to bypass authentication mechanisms, gain administrator privileges and install ASPX web shells on compromised servers. Microsoft recommends prioritizing installing updates on Microsoft Exchange 2013, 2016 and 2019, Exchange Online is not affected.

Recommendations

Install the security updates, available at: https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901
Check network and host logs for indicators of compromise released by Microsoft & Volexity
Ensure Microsoft Exchange servers are up to date and have logging enabled

Details

According to Microsoft, HAFNIUM primarily targets entities in the United States across several industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and non-governmental organizations. They have previously compromised victims by exploiting vulnerabilities in internet-facing servers, and have used legitimate open-source frameworks.

CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allows the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

The second vulnerability is CVE-2021-26857, an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit. The third vulnerability, CVE-2021-26858, is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials. The fourth vulnerability is CVE-2021-27065, a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

Suspected TTPs used by HAFNIUM

Tools:

Covenant: A .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform. Procdump: This tool is used to extract credentials from the OS memory. Since ProcDump is a signed Microsoft utility, AV usually doesn’t trigger on it. ProcDump creates a minidump of the target process from which Mimikatz can extract credentials. Nishang: A framework and collection of scripts and payloads which enables usage of PowerShell. (PowerShell v3 and above) PowerCat: Aka, Powershell Netcat which is a new version of netcat in the form of the powershell script. 7-Zip

Procedures:

Hafnium first gains access to an Exchange server either with a stolen password or by exploiting one of the Exchange server zero-days to appear as someone with legitimate access. Attackers then deploy a Web shell so they can remotely control an affected server. This remote access enables them to steal data from target organizations.

Impact:

After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server and may export the content of email inboxes and address books to a remote server. If not patched, these four zero-day vulnerabilities can be chained together to gain access to vulnerable Microsoft Exchange servers (both internal & external facing), steal email, and plant further malware to facilitate long-term access to victim environments.

IOCs

Web shell hashes:

b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0
097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e
2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1
65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5
511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1
4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea
811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d
1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944

IP addresses:

103.77.192.219
104.140.114.110
104.250.191.110
108.61.246.56
149.28.14.163
157.230.221.198
167.99.168.251
185.250.151.72
192.81.208.169
203.160.69.66
211.56.98.146
5.254.43.18
5.2.69.14
80.92.205.81
91.192.103.43