News for hackers. Stuff that matters.

A comment on 30k U.S. organizations newly hacked via holes in Microsoft Exchange Server. Parent comment

Re:30k U.S. organizations newly hacked via holes in Microsof... by darkwater on Saturday March 06, 2021 @04:25AM (#26366249)
Do you manage any Internet facing Exchange? If so, what have been your remediation strategy with this attack?
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by EvanAnderson on Saturday March 06, 2021 @04:47AM (#26366340)
All of them are Internet-facing. I have done a lot of patching and some restoring from backup (followed by parching) this week.

Some people disabled /ECP facing the Internet. It was "unsupported" by MSFT so I never did that. In retrospect it would have been worth the gamble. If I had it to do over again I would have taken that bet.

None of the compromised boxes I saw this week showed signs of post-exploit activity. They dropped their payload and left. Every compromised box was restored from backup, temporarily isolated from the Internet, and patched.

[ Parent | on HN ]