Live Breaking News & Updates on Havei Been Compromised

Sophos: How timely intervention stopped a ProxyLogon attack
A recent incident at an undisclosed customer sheds new light on how malicious actors exploit unpatched Microsoft Exchange servers
Share this item with your network:
By
Published: 05 May 2021 14:00
Cyber security researchers at Sophos have been sharing details of how they were able to cut off an ongoing cyber attack on one of their customers, which exploited the dangerous ProxyLogon vulnerabilities in on-premise instances of Microsoft Exchange Server.
The customer, whose identity has not been revealed, is a large North American organisation with about 15,000 endpoints in play. It was initially compromised on 16 March 2021, a couple of weeks after the ProxyLogon zero-days were disclosed, via CVE-2021-26855 and CVE-2021-27065, which were leveraged to execute a malicious PowerShell command on the vulnerable server. ....

France General , United States , United Kingdom , Dan Schiappa , Andrew Brandt , Microsoft Exchange Servers , Microsoft Exchange Server , Us Justice Department , Microsoft Exchange , North American , Havei Been Compromised , Remote Utilities , Cobalt Strike , Sopho Managed Threat Response , பிரான்ஸ் ஜநரல் , ஒன்றுபட்டது மாநிலங்களில் , ஒன்றுபட்டது கிஂக்டம் , ஆண்ட்ரூ பிராண்ட் , மைக்ரோசாஃப்ட் பரிமாற்றம் சேவையகங்கள் , மைக்ரோசாஃப்ட் பரிமாற்றம் சேவையகம் , எங்களுக்கு நீதி துறை , மைக்ரோசாஃப்ட் பரிமாற்றம் , வடக்கு அமெரிக்கன் , தொலைநிலை பயன்பாடுகள் , கோபால்ட் வேலைநிறுத்தம் ,