LockBit Ransomware in Microsoft Exchange Servers

Digital Transformation can be considered a double-edged sword; it can revolutionize business work processes but a lack of stable cyber security can result in catastrophic events. Cybercriminals are utilizing harmful malware such as LockBit ransomware to conduct operation disruption and data theft for personal financial gain. Therefore, companies lacking effective cyber defense mechanisms would encounter a massive loss. IT giant Microsoft has been reported to encounter a cyber attack; cybercriminals have hacked Microsoft exchange servers to deploy LockBit ransomware. The company is now working on patching up zero-day bugs which have been exploited by hackers to release this particular ransomware. Zero-Day Vulnerabilities on Microsoft Exchange Servers Microsoft is no stranger to cyber threats as the company provides the largest threat surface due to the mass usage of Microsoft products.

• Previously on July 2022, threat actors managed to infect two exchange servers with LockBit 3.0 ransomware.
• A previously deployed web shell on those compromised servers was used to steal around 1.3 TB of crucial data.
• Reports claim those threat actors took only 7 days to hijack AD admin privileges.

Microsoft has hired AhnLab, a South Korean cyber security agency to conduct digital forensic investigations of this incident. Forensic analysis experts reported that an “undisclosed zero-day vulnerability” was likely exploited by hackers to deploy LockBit ransomware. At present, Microsoft is actively working on zero-days identified as CVE-2022-41040 and CVE-2022-41082, although AhnLab stated that there was a possibility of a different attacker using a different zero-day vulnerability as there was a difference in the delivery method.   Ransomware Attack Prevention Hacking incidents and online threats are constantly rising at an alarming rate and therefore, every enterprise must require a suitable cyber security plan to minimize incidents of data loss and identify theft. The following measures should be taken:

• Deploying advanced cyber security defense mechanism
• Conducting 24×7 online monitoring to identify suspicious activities
• Identifying security weaknesses with VAPT audit
• Periodically reviewing critical infrastructure and security controls
• Utilizing suitable solutions specifically targeted toward ransomware prevention

Thanks to modern technological advancements, cyber security defense plans are capable of ensuring complete protection against multiple types of online threats to promote data privacy, confidentiality, and integrity. The best defense against online threats is adopting a proactive cyber security plan that covers every aspect of a possible risk factor to ensure a secured cyber environment as well as improve cyber resiliency. We, a CERT-In empanelled agency, is the most preferred cyber security advisor which supports key public as well as private sector enterprises in the industry delivering state-of-the-art solutions on vulnerability assessment and penetration testing (VAPT), managed security services, web application audit, NoC, SoC, SIEM/SOAR and other security solutions. We also offer Virtual CISO services to your organization through specialized cyber security expertise in developing a stable security program and reducing cyber vulnerabilities and risks. Our Anti-Ransomware Readiness (ARR) Audit is a combination of active and passive non-intrusive techniques that delivers a strong technical process to an organization to mitigate ransomware threats. Do check our website www.primeinfoserv.com for more details or write us at info@primeinfoserv.com or contact us at +913340085677 for cyber security queries.