{"id":155892,"date":"2023-12-07T10:22:42","date_gmt":"2023-12-07T10:22:42","guid":{"rendered":"https:\/\/www.stellarinfo.com\/blog\/?p=155892"},"modified":"2023-12-21T10:07:44","modified_gmt":"2023-12-21T10:07:44","slug":"how-to-protect-your-exchange-server-from-vulnerability-flaws-and-hacks","status":"publish","type":"post","link":"https:\/\/www.stellarinfo.com\/blog\/protect-exchange-server-from-vulnerability\/","title":{"rendered":"How to Protect your Exchange Server from Threat Groups, like Forest Blizzard?"},"content":{"rendered":"

Microsoft has recently identified a threat group, called Forest Blizzard (also known as APT28, STONTIUM, and Fancy Bear) that has been actively exploiting a vulnerability (CVE-2023-23397) since March 2023 to get unauthorized access to email accounts (Outlook) in Exchange Servers. The threat group has primarily targeted organizations in transportation and energy sectors as well as government and non-governmental entities, spread across the United States, the Middle East, and Europe. <\/p>

CVE-2023-23397 is a vulnerability that mainly affects Microsoft Outlook (on Windows). It is a critical privilege escalation bug that allows the attacker to access Net-NTLMv2 hash of the user. It is then used to gain access to the user account. Though it was patched by Microsoft in March 2023, the threat actor is still exploiting this vulnerability.<\/p>

According to Microsoft, in September 2023, the threat actor – Forest Blizzard – had exploited a zero-day vulnerability (CVE-2023-38831) in WinRAR that was earlier recognized in August 2023. Though the patch for this WinRAR’s vulnerability is available, the threat actor continue to target the systems that are using the unpatched software version. Other known vulnerabilities exploited by Forest Blizzard include CVE-2021-40444, CVE-2021-42321, CVE-2021-42292, CVE-2020-17144, CVE-2021-34473, and CVE-2020-0688<\/strong>.<\/p>

How to Protect against such Attacks?<\/h2>

Microsoft had already released a patch for the CVE-2023-23397 vulnerability, which is available for all the supported Outlook versions. The company has urged the users to promptly install the patch and keep their applications and servers up-to-date to mitigate this threat. Users can use the Microsoft Defender XDR, a unified portal containing various security solutions, to detect the exploitation and post-compromise activities of the CVE-2023-23397 vulnerability. <\/p>

Microsoft has also partnered with the Polish Cyber Command (DKWOC) to counter the actions of Forest Blizzard. DKWOC is offering a toolkit to detect suspicious mailbox folder sharing in Microsoft Exchange Servers. The toolkit also provides recommendations and guidelines that users can follow, in case compromise is suspected.<\/p>

Steps to Protect Exchange Server from Threats and Attacks<\/h2>

Follow the below steps to identify the vulnerabilities and patch them to protect the organization against malicious attacks.<\/p>

<\/a>1. Use the Exchange Server Health Checker<\/h3>

You can use Microsoft’s Exchange Server Health Checker PowerShell script to check the health of your Exchange Server. Based on the information, you can take necessary corrective actions. Below are the steps to use the Exchange Server Health Checker PowerShell script.<\/p>

\n

Note:<\/strong> This script works only for Exchange 2019, 2016, and 2013.<\/p>\n<\/blockquote>