--- title: Microsoft Reports Exploitation of Microsoft Exchange Server description: Charles River Insurance is dedicated to providing our customers with solutions beyond their policies. Cyber insurance is becoming increasingly important. image: https://www.charlesriverinsurance.com/hubfs/cyber-security.jpg --- [![CR_final_logo_white](https://www.charlesriverinsurance.com/hs-fs/hubfs/CR_final_logo_white.png?width=1317&name=CR_final_logo_white.png "CR_final_logo_white")](https://www.charlesriverinsurance.com/) [![quote now](https://no-cache.hubspot.com/cta/default/1738700/0df88c31-4531-4b8f-8a14-8e2a212096e8.png)](https://cta-redirect.hubspot.com/cta/redirect/1738700/0df88c31-4531-4b8f-8a14-8e2a212096e8) [![](https://www.charlesriverinsurance.com/hs-fs/hubfs/CR_final_logo_white.png?width=1317&height=205&name=CR_final_logo_white.png)](http://charlesriverinsurance.com) # Microsoft Reports Exploitation of Microsoft Exchange Server ![](https://www.charlesriverinsurance.com/hubfs/caring-hands.png) **by** *[Charles River Insurance](https://www.charlesriverinsurance.com/blog/author/charles-river-insurance)* **on** *Mar 11, 2021 9:40:46 AM* - [Tweet](https://twitter.com/share) *Charles River Insurance is dedicated to providing our customers with solutions beyond their policies. As an industry leader we strongly urge all of our clients - not just regulated entities - to take this matter very seriously. If you have questions about your policy and whether cyber coverage is a part of your portfolio, please contact your agent immediately. If you are not covered for cyber insurance, we will be happy to provide you with a free quote to make sure you are properly protecting your assets.* In the last week, many organizations were compromised via zero-day vulnerabilities in Microsoft Exchange Server.  On March 2, 2021, [Microsoft](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/) made patches available for these vulnerabilities, however, it was too late for many organizations, which were compromised before the patches were available or before they had the chance to apply them.  At Charles River Insurance, we strongly urge clients with vulnerable Microsoft Exchange services to act immediately.  Especially if you operate a regulated entity, you should immediately patch or disconnect all vulnerable servers, and use the [tools](https://github.com/microsoft/CSS-Exchange/tree/main/Security) provided by Microsoft to identify and remediate any compromise stemming from these exploitations. The U.S. Department of Homeland Security Cybersecurity & Infrastructure Security Agency (“CISA”) has also released a [current activity update](https://us-cert.cisa.gov/ncas/current-activity/2021/03/06/microsoft-ioc-detection-tool-exchange-server-vulnerabilities) outlining how to search for a compromise. ## **What Happened, and When?** On March 2, 2021, [Microsoft](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/) reported that four vulnerabilities were discovered in the Microsoft Exchange servers from 2013 and later (including 2016, 2019). The vulnerable servers appear to self-host Web versions of Microsoft’s email program Outlook on their own machines rather than enrolling in a cloud provider program. It also appears that the vulnerabilities did not begin on March 2, rather - they appear to have been happening for a long while beforehand. Widespread exploitation of the vulnerabilities is [ongoing, ](https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/)meaning time is of the essence. If your servers have not been exploited yet, it is still possible that they will be.  On March 2nd Microsoft also [released](https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/) several security updates for vulnerabilities affecting the on-premises versions of Microsoft Exchange Server. The Common Vulnerabilities and Exposures (“CVE”) exploited were CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065.  Microsoft has stated that these exploits “*require the ability to make an untrusted connection to Exchange server port 443. This can be protected against by restricting untrusted connections or by setting up a VPN to separate the Exchange server from external access*.” Other vulnerabilities given attention in the March 2nd updates were CVE-2021-26412, CVE-2021-26854, and CVE-2021-27078. According to Microsoft, however, these fixes are “*not related to known attacks*.”  ## U.S. Department of Homeland Security Cybersecurity & Infrastructure Security Agency Recommendations: As of March 5, 2021, CISA Emergency Directive 21-02: [Mitigate Microsoft Exchange On-Premises Product Vulnerabilities](https://cyber.dhs.gov/ed/21-02/) recommends immediately applying the correct patches to all known vulnerabilities, as well as preserving forensics of the cyber event. CISA reported that hackers deployed web shells on the compromised servers to establish persistent access to the victims' network.  Web shells allow attackers to steal data and perform additional malicious actions. It is important to note that simply installing the patches will not remove malicious web shells that were deployed before patching. We strongly recommend that you follow the steps provided in the CISA Emergency Directive to identify exploited servers and find web shells.  Here are some resources to assist you: - Microsoft Advisory: [Multiple Security Updates Released for Exchange Server](https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901) - Microsoft Blog: [HAFNIUM targeting Exchange Servers with 0-day exploits](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/) - Microsoft GitHub Repository: [CSS-Exchange](https://github.com/microsoft/CSS-Exchange) - CISA Alert (AA21-062A): [Mitigate Microsoft Exchange Server Vulnerabilities](https://us-cert.cisa.gov/ncas/alerts/aa21-062a) Regulated entities should immediately assess the risk to their systems and consumers, and take steps necessary to address vulnerabilities and customer impact. Your assessment should identify internal use of vulnerable Microsoft Exchange products and any use of these products by critical third parties. Regulated entities should also continue to track developments in this compromise and respond quickly to new information. Regulated entities are reminded to report Cybersecurity Events as promptly as possible and within 72 hours at the latest.   ### How Can We Help? ### Related Posts ![CR_final_logo_white](https://www.charlesriverinsurance.com/hs-fs/hubfs/CR_final_logo_white.png?width=349&height=54&name=CR_final_logo_white.png)![ACCCE-AllianceMember-CannabisRiskManagementlge](https://www.charlesriverinsurance.com/hs-fs/hubfs/ACCCE-AllianceMember-CannabisRiskManagementlge.png?width=99&name=ACCCE-AllianceMember-CannabisRiskManagementlge.png)   [Please leave us a review on Google!](https://g.page/r/CUoCbcGtSEUjEAg/review) ## Framingham Office 1661 Worcester Rd. Suite 402  Framingham, MA 01701 **Phone: [508-656-1400](tel:508-656-1400)** ## Leominster Office 29 Main Street Leominster, MA 01453 **Phone: [978-343-6946](tel:9783436946)** This material is for informational purposes only. All statements herein are subject to the provisions, exclusions and conditions of the applicable policy, state and federal laws. For an actual description of coverage, terms and conditions, please refer to the applicable insurance policy or check with your insurance professional. The illustrations, instructions and principles contained in the material are general in scope and, to the best of our knowledge, current at the time of publication. [Privacy Policy](https://www.charlesriverinsurance.com/massachusetts-insurance-privacy-policy)