Unpatched Exchange servers could be behind Rackspace’s ransomware attack, according to one researcher

Getty Pictures

Rackspace’s a short while ago confirmed ransomware attack allegedly may have been facilitated by hackers exploiting the company’s out-of-day Exchange clusters, in accordance to just one researcher.

The cloud computing agency confirmed the attack on 6 December had impacted its hosted Microsoft Exchange ecosystem, the fallout from which is leading to provider disruptions for consumers.

It was advised by security researcher Kevin Beaumont that the cyber criminals ended up able to launch their attack immediately after exploiting Exchange server clusters that did not show up to have been patched since August 2022, right before the patches for the ProxyNotShell exploit had been introduced.

In his analysis Beaumont added that Trade log establish quantities aren’t constantly dependable, and the breach could have transpired since of other issues.

Microsoft introduced the patch for the ProxyNotShell vulnerability at the commence of November. It implemented fixes for two security issues that affect Microsoft Trade Server 2013, 2016, and 2019. Attackers have been in a position to escalate privileges to run PowerShell and reach arbitrary or remote code execution, enabling them to focus on server accounts. Attackers can then test to result in malicious code.

“The Microsoft-equipped mitigations for ProxyNotShell are bypassable,” stated Beaumont. “IIS rewrite, which Microsoft made use of for mitigations, does not decode all URLs appropriately and as these types of can be bypassed for exploitation. If you relied on the PowerShell mitigation or EEMS software, your Trade Server is nevertheless vulnerable – Microsoft just hasn’t instructed you this clearly. The correct is to patch.”

He extra that the exploits purpose without having multi-factor authentication as Trade Server does not support Contemporary Authentication, owing to Microsoft deprioritising this implementation perform.

“If you are an MSP jogging a shared cluster, such as hosted Exchange, it usually means that 1 compromised account on one client will compromise the entire hosted cluster. This is large risk,” said Beaumont.

Scale of the attack

Rackspace thinks the attack only impacted its hosted Trade business, and its other merchandise and solutions are completely operational.

It’s fully commited to applying further security measures and is monitoring its methods for any suspicious exercise. It has also hired an incident response firm to look into the make any difference, along with its inner security workforce. 

Rackspace is serving to Hosted Trade buyers to migrate their data to a new ecosystem as speedily as it can, it stated. It has greater the total of assistance employees it has to support with this and is aiming to assist clients by the migration method so that their have functions are not impacted as much. 

“Although Rackspace Technology is in the early stages of evaluating this incident, the incident has caused and may continue on to result in an interruption in its Hosted Trade business enterprise and could consequence in a loss of revenue for the hosted Trade company, which generates close to $30 million of once-a-year earnings in the applications and cross-system section,” mentioned the enterprise. “In addition, Rackspace Technology could have incremental expenses connected with its reaction to the incident.”

Thousands of corporations across the entire world will feel the implications of this attack, stated Jordan Schroeder, handling CISO at Barrier Networks. He explained that it will also underline the responsibility organisations that retail outlet or host company info have to also maintain it safe.

“Rackspace also should re-consider its defences towards ransomware, due to the fact when it arrives to modern threats, avoidance is generally superior than get rid of,” explained Schroeder. “This will involve re-creating their cyber hygiene baseline, employing zero rely on principles to restrict the effects of breaches by preserving vital accounts and preventing lateral movement, and teaching workforce regularly on cybersecurity and the evolving danger landscape.”

The firm very first noted that the incident commenced on 2 December, communicating that it was investigating an issue on its hosted Trade environments.

Several hours later on, it explained to consumers it was doing the job by an issue with hosted Exchange accounts and that it experienced proactively shut down the natural environment to stay away from further issues. It also gave shoppers access to Microsoft Exchange Plan 1 licences on Microsoft 365 as a non permanent workaround.

The subsequent working day, Rackspace stated the issue was a security incident that impacted a portion of its hosted Exchange platform. On 4 December, the business explained the incident was established to be an extended outage of the hosted Trade.

It urged prospects to transfer to Microsoft 365, indicating this was the most effective option. Whilst it said that it experienced restored email companies to hundreds of clients on Microsoft 365, it said that it comprehended that self-migration wasn’t easy and could be challenging to apply.

Some components of this short article are sourced from:
www.itpro.co.uk