New Delhi: Microsoft has warned its customers against a new sophisticated nation-state cyber attack that has its origin in China and is primarily targeting on-premises ‘Exchange Server’ software of the tech giant.
Called “Hafnium,” it operates from China and is attacking infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and NGOs in the US for the purpose of exfiltrating information.
“While Hafnium is based in China, it conducts its operations primarily from leased virtual private servers (VPS) in the US,” said Tom Burt, Corporate Vice President, Customer Security and Trust at Microsoft.
The Microsoft Threat Intelligence Center (MSTIC) found that “Hafnium” would first gain access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise itself as someone who should have access.
“Second, it would create what’s called a web shell to control the compromised server remotely. Third, it would use that remote access — run from the US-based private servers — to steal data from an organization’s network,” Burt said in a statement .
The company has released security updates to protect customers running Exchange Server, and encourages all Exchange Server customers to apply these updates immediately.
“Exchange Server is primarily used by business customers, and we have no evidence that Hafnium’s activities targeted individual consumers or that these exploits impact other Microsoft products,” Burt informed.
This is the eighth time in the past 12 months that Microsoft has publicly disclosed nation-state groups targeting institutions critical to civil society.
