SSRF attacks hit 100,000 businesses globally since November

guest · Jan 24, 2023

By Alex Scroxton - January 24, 2023

Security teams are warned to be on the lookout for a growing wave of opportunistic and largely untargeted cyber attacks exploiting two related exploit chains to target Microsoft Exchange servers.
Click to expand...

This is according to Bitdefender Labs, which noted an uptick in attack volumes beginning at the end of November 2022. The attacks are technically known as server-side request forgeries (SSRF), and are rapidly becoming widely popular and routinely exploited by the cyber criminal underground – mainly because Microsoft Exchange is so widely used.
Click to expand...

There are two exploit chains currently under active exploitation. The first is ProxyNotShell, a combination of two disclosed vulnerabilities, CVE-2022-41080 and CVE-2022-41082 that requires the threat actor to authenticate to the vulnerable server, and was patched by Microsoft in November 2022.

The second is known as OWASSRF. This is a slightly different exploit chain that uses the same two vulnerabilities, albeit slightly differently in such a way that it can bypass the ProxyNotShell mitigations. OWASSRF was used in the December 2022 Rackspace attack.
Click to expand...

The research team claims that more than 100,000 organisations globally have fallen victim to SSRF attacks in the past couple of months, with the majority of victims in the US and Europe. Victims were found in multiple sectors including arts and entertainment, consultancy, legal, manufacturing, real estate and wholesale.

“While the initial infection vector keeps evolving and threat actors are quick to exploit any new opportunity, their post-exploitation activities are familiar. The best protection against modern cyber attacks is a defence-in-depth architecture,” the Bitdefender team wrote.
Click to expand...

Bitdefender: Technical Advisory: Proxy*Hell Exploit Chains in the Wild

By Martin Zugec - January 24, 2023
At the end of November 2022, experts from Bitdefender Labs started to notice an increase in attacks using ProxyNotShell/OWASSRF exploits chains to target on-premises Microsoft Exchange deployments. SSRF attacks on Microsoft Exchange servers are some of the most popular and routinely exploited vulnerabilities. We decided to release a technical advisory describing these attacks, but also documenting some of the recent attacks that we’ve detected in the wild.
Click to expand...

Log in or Sign up

SSRF attacks hit 100,000 businesses globally since November

guest Guest

Log in or Sign up

SSRF attacks hit 100,000 businesses globally since November

guest Guest

Useful Searches