Rackspace Confirms Play Ransomware Gang Responsible for Recent Breach

Cloud companies provider Rackspace on Thursday verified that the ransomware gang acknowledged as Participate in was liable for final month’s breach.

The security incident, which took spot on December 2, 2022, leveraged a formerly unidentified security exploit to achieve original entry to the Rackspace Hosted Exchange email ecosystem.

“This zero-working day exploit is connected with CVE-2022-41080,” the Texas-primarily based enterprise mentioned. “Microsoft disclosed CVE-2022-41080 as a privilege escalation vulnerability and did not consist of notes for becoming portion of a remote code execution chain that was exploitable.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Rackspace’s forensic investigation observed that the risk actor accessed the Particular Storage Desk (.PST) of 27 prospects out of virtually 30,000 clients on the Hosted Trade email surroundings.

Nonetheless, the enterprise claimed there is no proof the adversary seen, misused, or dispersed the customer’s e-mails or details from those particular storage folders. It further mentioned it intends to retire its Hosted Trade system as section of a planned migration to Microsoft 365.

It really is not at the moment not identified if Rackspace compensated a ransom to the cybercriminals, but the disclosure follows a report from CrowdStrike final month that shed gentle on the new technique, dubbed OWASSRF, employed by the Participate in ransomware actors.

The system targets Exchange servers that are unpatched against the ProxyNotShell vulnerabilities (CVE-2022-41040 and CVE-2022-41082) but have in area URL rewrite mitigations for the Autodiscover endpoint.

This entails an exploit chain comprising CVE-2022-41080 and CVE-2022-41082 to attain distant code execution in a way that bypasses the blocking principles by means of Outlook Web Access (OWA). The flaws were resolved by Microsoft in November 2022.

The Windows maker, in a statement shared with The Hacker News, urged customers to prioritize setting up its November 2022 Trade Server updates and that the reported method targets vulnerable techniques that have not not used the most up-to-date fixes.

Found this article attention-grabbing? Abide by us on Twitter  and LinkedIn to examine much more distinctive written content we put up.