A ransomware attack is starting to exploit the recently-disclosed flaws in Microsoft Exchange Server.
The ransomware strain, dubbed DearCry, has been spotted encrypting vulnerable Exchange servers in an effort to hold the data hostage. On Thursday, Microsoft said it was both detecting and blocking DearCry from hitting unpatched servers.
The security researcher Michael Gillespie has also noticed the DearCry attacks. He runs a service, called ID Ransomware, where victims can submit ransomware samples to help them identify which strain they’ve been infected with.
On Thursday, Gillespie tweeted ID Ransomware had received some submissions about DearCry ransomware hitting Exchange servers based in the US, Canada and Australia.
A victim of the attacks has also posted their experience with the ransomware on a BleepingComputer.com forum. The hacker behind DearCry has been asking the victim to pay $16,000 in bitcoin in order to receive a key to free the encrypted data.
“Luckily, this was just an email server, and I have a backup, but I may string him along just for the heck of it…” the victim wrote.
Andrew Thompson, a manager at the security firm Mandiant, is pointing out the DearCry attacks can only encrypt the Exchange server itself — not the rest of a company’s corporate network. “I have not seen mentions of an adversary using the Exchange Server vulnerabilities to conduct a deeper intrusion for purposes of deploying ransomware widely through the environment—YET. That nuance matters when reporting,” he said in a tweet.
Indeed, security researchers are warning it may only be a matter of time before more ransomware hackers decide to exploit the vulnerabilities. The flaws in Microsoft Exchange can enable an attacker to remotely take over a server, and loot the emails inside. That’s particularly problematic if the emails contain passwords for other IT systems, or hold confidential information, which a hacker could threaten to leak.
The security firm ESET has noticed at least ten hacking groups have been exploiting the flaws to infiltrate thousands of servers across the globe. Both Microsoft and the US government are urging affected customers to install the patches as soon as possible, and to also check the servers for any signs of malware.
