Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

volexity.com · 2 Mar 2021 · Licence: not cleared; local research copy only

CVEs this report names

1 CVE

CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote Services T1505.003Web Shell+2 more · 5 reports
>99.9%Top 0.01%
89.4priority

Where it names them

CVE-2021-26855

[UPDATE] March 8, 2021 – Since original publication of this blog, Volexity has now observed that cyber espionage operations using the SSRF vulnerability CVE-2021-26855 started occurring on January 3, 2021, three days earlier than initially posted.

Original ↗

Through its analysis of system memory, Volexity determined the attacker was exploiting a zero-day server-side request forgery (SSRF) vulnerability in Microsoft Exchange (CVE-2021-26855).

Original ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.