Ransomware Hackers Start Exploiting Microsoft Exchange Server Flaws

Ransomware is starting to exploit recently disclosed flaws in Microsoft Exchange Server. 

The ransomware strain, dubbed DearCry, has been spotted encrypting vulnerable Exchange servers in an effort to hold the data hostage.

On Thursday, Microsoft it was both detecting and blocking DearCry from hitting unpatched servers. 

Security researcher Michael Gillespie also noticed the DearCry attacks.

He runs a service, called ID Ransomware, where victims can submit ransomware samples to help them identify which strain they’ve been infected with. 

On Thursday, Gillespie that ID Ransomware had received some submissions about DearCry ransomware hitting Exchange servers based in the US, Canada, and Australia. 

A victim of the attacks also posted their experience with the ransomware on a BleepingComputer.com forum.

The hacker behind DearCry asked the victim to pay $16,000 in bitcoin in order to receive a key to free the encrypted data. 

“Luckily, this was just an email server, and I have a backup, but I may string him along just for the heck of it,” the victim wrote. 

Andrew Thompson, a manager at the security firm Mandiant, points out the DearCry attacks can only encrypt the Exchange server itself—not the rest of a company’s corporate network.

“I have not seen mentions of an adversary using the Exchange Server vulnerabilities to conduct a deeper intrusion for purposes of deploying ransomware widely through the environment—YET.

That nuance matters when reporting,” he said in a . 

Indeed, security researchers are warning it may only be a matter of time before more ransomware hackers decide to exploit the vulnerabilities.

The flaws in Microsoft Exchange can enable an attacker to remotely take over a server and loot the emails inside.

That’s particularly problematic if the emails contain passwords for other IT systems, or hold confidential information, which a hacker could threaten to leak.  

Security firm ESET spotted at least 10 hacking groups exploiting the flaws to infiltrate thousands of servers across the globe.

Both Microsoft and the US government are urging affected customers to install patches as soon as possible, and to check servers for any signs of malware.

Ransomware is starting to exploit recently disclosed flaws in Microsoft Exchange Server. 

The ransomware strain, dubbed DearCry, has been spotted encrypting vulnerable Exchange servers in an effort to hold the data hostage.

On Thursday, Microsoft it was both detecting and blocking DearCry from hitting unpatched servers. 

Security researcher Michael Gillespie also noticed the DearCry attacks.

He runs a service, called ID Ransomware, where victims can submit ransomware samples to help them identify which strain they’ve been infected with. 

On Thursday, Gillespie that ID Ransomware had received some submissions about DearCry ransomware hitting Exchange servers based in the US, Canada, and Australia. 

A victim of the attacks also posted their experience with the ransomware on a BleepingComputer.com forum.

The hacker behind DearCry asked the victim to pay $16,000 in bitcoin in order to receive a key to free the encrypted data. 

“Luckily, this was just an email server, and I have a backup, but I may string him along just for the heck of it,” the victim wrote. 

Andrew Thompson, a manager at the security firm Mandiant, points out the DearCry attacks can only encrypt the Exchange server itself—not the rest of a company’s corporate network.

“I have not seen mentions of an adversary using the Exchange Server vulnerabilities to conduct a deeper intrusion for purposes of deploying ransomware widely through the environment—YET.

That nuance matters when reporting,” he said in a . 

Indeed, security researchers are warning it may only be a matter of time before more ransomware hackers decide to exploit the vulnerabilities.

The flaws in Microsoft Exchange can enable an attacker to remotely take over a server and loot the emails inside.

That’s particularly problematic if the emails contain passwords for other IT systems, or hold confidential information, which a hacker could threaten to leak.  

Security firm ESET spotted at least 10 hacking groups exploiting the flaws to infiltrate thousands of servers across the globe.

Both Microsoft and the US government are urging affected customers to install patches as soon as possible, and to check servers for any signs of malware.