Hive malware operators attack Microsoft Exchange servers

Hive ransomware operators attack Microsoft Exchange servers that are vulnerable to the notorious ProxyShell problems.

On compromised machines, attackers deploy various backdoors, including Cobalt Strike beacons, then conduct reconnaissance, steal credentials and valuable information, and only then proceed to encrypt files.

Varonis, who are investigating what is happening after a ransomware attack on one of their customers, warned about the issue.

Let me remind you that the vulnerabilities, which were collectively called ProxyShell, became known in the summer of 2021.

Let me remind you that we, פֿאַר בייַשפּיל, talked about Hancitor מאַלוואַרע, which uses phishing emails, compromised credentials, or brute-forcing RDP to access vulnerable Windows machines and exploits vulnerabilities in Microsoft Exchange.

Previously, ProxyShell bugs have already been used by many attackers, including such well-known hack groups as Conti, BlackByte, Babuk, Cuba און LockFile. צום באַדויערן, the Hive attacks show that not everyone has patched ProxyShell yet, and vulnerable servers can still be found on the network.

After exploiting ProxyShell bugs, Hive operators inject four web shells into an accessible Exchange directory and execute PowerShell code with high privileges, loading Cobalt Strike stagers. The researchers note that the web shells used in these attacks were taken from a public Git repository and then simply renamed to avoid detection.

On the attacked machines, the attackers also use the Mimikatz infostealer to steal the password from the domain administrator account and perform a lateral movement. In this way, hackers look for the most valuable data in order to force the victim to pay a ransom later.