{"uuid": "6180d8e2-a0ee-439e-9b41-71afdf4b2ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-41080", "type": "seen", "source": "https://t.me/hacking_Attack/84953", "content": "Black Hat Ethical Hacking\nMicrosoft: Cuba ransomware hacking Exchange servers via OWASSRF flaw\n\nMicrosoft: Cuba ransomware hacking Exchange servers via OWASSRF flawPost Views: 48 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft says Cuba ransomware threat actors are hacking Microsoft Exchange servers unpatched against a critical server-side request forgery (SSRF) vulnerability also exploited in Play ransomware attacks.Cloud computing provider Rackspace recently confirmed\u00a0that Play ransomware used a zero-day exploit dubbed OWASSRF targeting this bug (CVE-2022-41080) to compromise unpatched Microsoft Exchange servers on its network after bypassing ProxyNotShell URL rewrite mitigations.\n\nAccording to Microsoft, the Play ransomware gang has abused this security flaw since late November 2022. The company advises customers to prioritize CVE-2022-41080 patching to block potential attacks.\n\nRedmond says that this SSRF vulnerability has also been exploited since at least November 17th by another threat group it tracks as DEV-0671 to hack Exchange servers and deploy Cuba ransomware payloads.\n\nMicrosoft shared this info in a January update to a private threat analytics report seen by BleepingComputer and available to customers with Microsoft 365 Defender, Microsoft Defender for Endpoint Plan 2, or Microsoft Defender for Business subscriptions.\n\nWhile Microsoft released security updates to address this SSRF Exchange vulnerability on November 8th and has provided some of its customers with info that ransomware gangs are using the flaw, the advisory\u00a0is yet to be updated to warn that it\u2019s being exploited in the wild.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your Exchange servers against OWASSRF attacksThe OWASSRF exploit spotted by CrowdStrike security researchers on Rackspaces\u2019s network was also shared online\u00a0together with some of Play ransomware\u2019s other malicious tools.\n\nThis will make it easier for other cybercriminals to adapt Play ransomware\u2019s tooling for their own purposes or create their own custom CVE-2022-41080 exploits, adding to the urgency of patching the vulnerability as soon as possible.\n\nOn Tuesday, Cybersecurity and Infrastructure Security Agency (CISA) also ordered Federal Civilian Executive Branch Agencies (FCEB) agencies to patch their systems against this bug by January 31st and strongly urged\u00a0all organizations to secure their Exchange servers to thwart exploitation attempts.\n\nOrganizations with on-premises Microsoft Exchange servers on their networks should deploy the latest Exchange security updates immediately (with November 2022 as the minimum patch level) or disable Outlook Web Access (OWA) until they can apply CVE-2022-41080 patches.\nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia\nTrending: Digital Forensics Tool: Dangerzone Cuba ransomware behind more than 100 attacks worldwideThe FBI and CISA revealed\u00a0in a joint security advisory issued last month that the Cuba ransomware gang has raked in more than $60 million in ransoms as of August 2022 after breaching over 100 victims worldwide.\n\nAlthough\u00a0this paints a bleak picture, samples submitted by victims to the ID-Ransomware platform analysis show that the gang is not very active, proving that even a somewhat inactive ransomware operation can have a huge impact.\nhttps://www.bleepstatic.com/images/news/u/1109292/2023/Cuba%20ransomware%20ID-Ransomware%20sample%20submissions.png \n<figcaptionCuba ransomware sample submissions (ID-Ransomware) \nAnother FBI advisory from December 2021 warned that the ransomware group had compromised a[...]", "creation_timestamp": "2026-09-02T01:01:28.047052Z"}