![\"NSA:](\"https:\/\/www.bleepstatic.com\/content\/posts\/2020\/05\/28\/Sandworm.jpg\")
<\/p>\n<\/p>\n
The U.S. National Security Agency (NSA) says that Russian military threat actors known as Sandworm Team have been exploiting a critical flaw in the Exim mail transfer agent (MTA) software since at least August 2019.<\/p>\n
The vulnerability tracked as CVE-2019-10149 and named “The Return of the WIZard” makes it possible for unauthenticated remote attackers to execute arbitrary commands as root on vulnerable mail servers — for some non-default server configurations — after sending a specially crafted email.<\/p>\n
“When the patch was released last year, Exim urged its users to update to the latest version,” the agency says<\/a>. “NSA adds its encouragement to immediately patch to mitigate against this still current threat.”<\/p>\n GRU Main Center for Special Technologies (GTsST) hackers of Unit 74455 have started exploiting victims’ unpatched Exim serves after an update was issued on June 5, 2019<\/a>, for users to patch their vulnerable servers.<\/p>\n “The actors exploited victims using Exim software on their public-facing MTAs by sending a command in the ‘MAIL FROM’ field of an SMTP (Simple Mail Transfer Protocol) message,” the NSA explains.<\/p>\n The Exim vulnerability is used by the Russian Sandworm<\/a> hackers to download a shell script from an attacker-controlled domain to “add privileged users, disable network security settings, update SSH configurations to enable additional remote access, execute an additional script to enable follow-on exploitation.”<\/p>\n BleepingComputer has been able to obtain the script1.sh<\/em> script referenced in the exploit above, which allows us to see how the attack is conducted.<\/p>\n Upon execution, the script will execute a variety of commands that give them full access to the compromised server and any MySQL databases running on it.<\/p>\n For two of the Base64 encoded commands, Sandworm’s script will check the running processes for ‘Little Snitch’, a popular third-party macOS firewall.<\/p>\n If the process is present, the script will not continue executing the command, as seen in the code snippet below.<\/p>\n As mitigation measures, the NSA recommends patching their Exim servers immediately by installing version 4.93 or newer.<\/p>\n “Administrators can update Exim Mail Transfer Agent software through their Linux distribution’s package manager or by downloading the latest version from https:\/\/exim.org\/mirrors.html,” the agency says.<\/p>\n “Using a previous version of Exim leaves a system vulnerable to exploitation. System administrators should continually check software versions and update as new versions become available.”<\/p>\n The NSA also provides Indicators of Compromise and instructions on how to detect exploit attempts and unauthorized changes within this security advisory<\/a>.<\/p>\n Even though the Exim flaw is known to have been exploited in the wild since at least June 9, 2019 (1<\/a>, 2<\/a>), there still are millions of unpatched servers vulnerable to attacks.<\/p>\n According to a quick Shodan search, vulnerable versions of Exim are currently running on about Internet-exposed 2,481,000 servers<\/a>, with more than 2,467,000 servers<\/a> running the patched Exim 4.93 release. <\/p>\n Microsoft issued a warning in June 2019 about an active Linux worm targeting the Remote Code Execution (RCE) CVE-2019-10149 Exim mail server vulnerability, saying that Azure servers can still be infected or hacked by abusing the flaw even though existing mitigations could block the malware’s worm functionality.<\/p>\n One month later, attackers also started exploiting vulnerable Exim servers<\/a> trying to install the Watchbog Linux trojan with the end goal of adding the infected boxes to a Monero cryptomining botnet.<\/p>\n Tags:<\/b> Sergiu Gatlan<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":" The U.S. National Security Agency (NSA) says that Russian military threat actors known as Sandworm Team have been exploiting a critical flaw in the Exim mail transfer agent (MTA) software since at least August 2019. The vulnerability tracked as CVE-2019-10149 and named “The Return of the WIZard” makes it possible for unauthenticated remote attackers to execute arbitrary … Continue reading NSA: Russian govt hackers exploiting critical Exim flaw since 2019<\/span><\/a> Continue Reading Attacks started after the Exim flaw got patched<\/h2>\n
\n![\"Sample](\"https:\/\/www.bleepstatic.com\/images\/news\/u\/1109292\/2020\/Exploitation%20command.jpg\")
\n![\"Sandworm](\"https:\/\/www.bleepstatic.com\/images\/news\/u\/1109292\/2020\/image(2).png\")
\n
\n![\"LittleSnitch](\"https:\/\/www.bleepstatic.com\/images\/news\/u\/1109292\/2020\/image%20(1).png\")
Mitigation, detection, and defense measures<\/h2>\n
Warnings of attacks exploiting CVE-2019-10149<\/h2>\n
See Campaign: <\/strong>https:\/\/www.bleepingcomputer.com\/news\/security\/millions-of-exim-mail-servers-exposed-to-local-remote-attacks\/<\/a>
Contact Information:<\/b>
Sergiu Gatlan<\/p>\n
<\/a>, Wire<\/a>, United States<\/a>, English<\/a><\/p>\n<\/div>\n
\nContact Information:<\/h3>\n