Microsoft:

Critical Zero-Day Exploit in Progress: Microsoft Confirms Active Attacks on Exchange Servers

Microsoft has issued an urgent warning about a zero-day vulnerability (CVE-2024-21410) actively being exploited in on-premises Microsoft Exchange Server deployments. The flaw, classified as an elevation-of-privilege (EoP) vulnerability, allows attackers to escalate privileges to Domain Admin level, granting full control over affected systems.

Key Details:

• Who: Threat actors, including a state-sponsored group tracked as HAFNIUM, are exploiting the vulnerability. Microsoft attributes the attacks to this advanced persistent threat (APT) actor, known for targeting U.S.-based organizations in previous campaigns.
• What: The exploit enables attackers to bypass authentication and execute arbitrary code with highest-level privileges, potentially leading to data theft, ransomware deployment, or complete network compromise.
• When: The vulnerability was disclosed on February 13, 2024, with evidence of in-the-wild exploitation dating back to at least January 2024. Microsoft released an emergency patch as part of its February 2024 Patch Tuesday updates.
• Where: The attacks primarily target unpatched on-premises Exchange Server 2013, 2016, and 2019 installations. Cloud-based Exchange Online services are not affected.
• Why: The flaw stems from improper validation of NTLM (New Technology LAN Manager) relay requests, a legacy authentication protocol still used in some enterprise environments. Attackers leverage this to impersonate privileged users.

Impact:
Organizations running vulnerable Exchange servers face severe risks, including:

• Unauthorized access to sensitive emails, contacts, and calendar data.
• Lateral movement within networks, enabling attackers to compromise additional systems.
• Potential compliance violations under regulations like GDPR, HIPAA, or CCPA due to data exposure.

Microsoft has strongly urged administrators to apply the patch immediately and disable NTLM authentication where possible. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to remediate it by March 5, 2024. Private-sector organizations are advised to prioritize patching due to the high severity (CVSS 9.8) of the flaw.

Source: https://japantoday.com/category/national/update2-more-data-breaches-reported-by-japan-prefectural-police-forces-companies

Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security

"id": "mic1792650844",
"linkid": "microsoft-security",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'location': 'Global (primarily U.S.-based '
                                    'organizations)',
                        'name': 'Microsoft Exchange Server Customers',
                        'type': 'Organizations'}],
 'attack_vector': 'NTLM relay requests',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Emails, contacts, calendar data'},
 'date_detected': '2024-01-01',
 'date_publicly_disclosed': '2024-02-13',
 'description': 'Microsoft has issued an urgent warning about a zero-day '
                'vulnerability (CVE-2024-21410) actively being exploited in '
                'on-premises Microsoft Exchange Server deployments. The flaw '
                'allows attackers to escalate privileges to Domain Admin '
                'level, granting full control over affected systems.',
 'impact': {'data_compromised': 'Sensitive emails, contacts, and calendar data',
            'legal_liabilities': 'Potential compliance violations under GDPR, '
                                 'HIPAA, or CCPA',
            'operational_impact': 'Unauthorized access, lateral movement '
                                  'within networks',
            'systems_affected': 'Microsoft Exchange Server 2013, 2016, 2019 '
                                '(on-premises)'},
 'investigation_status': 'Ongoing',
 'motivation': 'State-sponsored cyber espionage',
 'post_incident_analysis': {'root_causes': 'Improper validation of NTLM relay '
                                           'requests'},
 'recommendations': 'Apply the patch immediately, disable NTLM authentication '
                    'where possible, prioritize remediation due to high '
                    'severity (CVSS 9.8)',
 'references': [{'source': 'Microsoft'},
                {'source': 'CISA Known Exploited Vulnerabilities (KEV) '
                           'catalog'}],
 'regulatory_compliance': {'regulations_violated': ['GDPR', 'HIPAA', 'CCPA'],
                           'regulatory_notifications': 'CISA added the '
                                                       'vulnerability to its '
                                                       'Known Exploited '
                                                       'Vulnerabilities (KEV) '
                                                       'catalog'},
 'response': {'containment_measures': 'Apply emergency patch, disable NTLM '
                                      'authentication where possible',
              'remediation_measures': 'Patch released as part of February 2024 '
                                      'Patch Tuesday updates'},
 'stakeholder_advisories': 'Federal agencies mandated to remediate by March 5, '
                           '2024; private-sector organizations advised to '
                           'prioritize patching',
 'threat_actor': 'HAFNIUM',
 'title': 'Critical Zero-Day Exploit in Progress: Microsoft Confirms Active '
          'Attacks on Exchange Servers',
 'type': 'Elevation-of-Privilege (EoP)',
 'vulnerability_exploited': 'CVE-2024-21410'}