Microsoft Exchange Server

Reported Context (22)

exploiting flaws using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while setting up persistence through VPN software and exfiltrating emails and credentials CISA Adds Five Flax Typhoon-Exploited Flaws to KEV, Sets October 11 Federal Deadline
Initial access combines XSS credential-harvesting pages delivering DiagTrack.exe malware with EBurst password spraying against Exchange. CISA Details How China-Linked Actors Steal Sensitive Data
or location of Zhang Yu, a Chinese national charged in the U.S. in connection with the 2021 Microsoft Exchange Server attacks. FBI Disrupts Flax Typhoon Tools Used to Target Critical Infrastructure
for flaws using a tool containing more than 1,300 scripts, guessed passwords for Microsoft 365 and Exchange accounts, and copied mailboxes using tools designed to collect mail. FBI Says China-Linked Hackers Stole Emails and Gave Third Parties Access
Microsoft Exchange Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories. CYFIRMA Report Finds Rising Ransomware and APT Activity Targeting Real Estate and Construction

CVE (101)

Malware (31)

People (24)

Threat Actors (81)

MITRE ATT&CK (114)

Vendors (43)

Products (168)

Tools (77)

Industries (37)

Countries (56)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.