.png
)
Urgent Security Alert for Businesses Worldwide
Organizations around the globe are being targeted by cybercriminals exploiting critical vulnerabilities in on-premises Exchange and SharePoint Servers. These sophisticated attacks not only compromise data but also jeopardize overall business integrity.
Advanced Attacks on Exchange and SharePoint Servers
Cyber attackers are employing more complex techniques to infiltrate systems, gaining enduring and pervasive access through:
- Remote code executions
- Lateral movements within networks
- Exfiltration of sensitive data
Given their repositories of critical data, Exchange and SharePoint servers are prime targets for these high-level threats.
Emergent Threat Tactics
NTLM Relay Attacks and Credential Theft
The deployment of NTLM relay attacks has become a prominent strategy for accessing Exchange Servers. This involves:
- Manipulating NTLM authentication protocols
- Stealing and relaying credentials to compromise user accounts
- Executing further illicit activities within the system
Similarly, SharePoint attacks are now more underhanded, with hackers subtly modifying files to embed web shell codes or installing remote management tools for continual, stealthy access.
Raising the Defense with AMSI Integration
In response to these threats, Microsoft has enhanced its security approach by integrating the Windows Antimalware Scan Interface (AMSI) within Exchange and SharePoint environments. This addition aids in:
- Inspecting incoming HTTP requests for malicious content
- Blocking harmful requests in real-time
- Enhancing protection against zero-day attacks
AMSI’s capabilities are crucial in preventing a variety of attack vectors, including SSRF attacks, web shell deployments, and credential theft.
Key Recommendations for Organizations
To safeguard against these vulnerabilities, organizations are advised to:
- Immediately apply all security updates and patches
- Activate AMSI integration and ensure all antimalware solutions are up-to-date
- Scrutinize and fortify NTLM authentication configurations
- Regularly monitor systems for any signs of unauthorized or abnormal activities
Stay vigilant and proactive to protect your critical infrastructure from sophisticated cyber threats.
Related: 7 Essential Strategies to Thwart Nation-State Cyber Attacks
Last Updated: April 19, 2025
