Shakedown Social

heise Security5 Jahre nach großem Microsoft-Exchange-Einbruch: Chinese verhaftetHunderttausende MS-Exchange-Server wurden 2020-2021 geknackt. Nun wollen die USA dafür einen Chinesen vor Gericht stellen. Er befindet sich in Italien.<a href="https://www.heise.de/news/5-Jahre-nach-grossem-Microsoft-Exchange-Einbruch-Chinese-verhaftet-10479651.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/5-Jahre-nach-grossem-Microsoft-Exchange-Einbruch-Chinese-verhaftet-10479651.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/Journal" class="mention hashtag" rel="nofollow noopener" target="_blank">#Journal</a> <a href="https://social.heise.de/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a> <a href="https://social.heise.de/tags/Spionage" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spionage</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a>

iX MagazinNeues Google-Tool: E-Mails einfach von Exchange Online zu Gmail migrierenIn der Datenmigration für Workspace finden Admins jetzt ein neues Tool, mit dem sie die E-Mails und Kalender ihrer Nutzer einfach von Microsoft kopieren können.<a href="https://www.heise.de/news/Neues-Google-Tool-E-Mails-einfach-von-Exchange-Online-zu-Gmail-migrieren-10443923.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/Neues-Google-Tool-E-Mails-einfach-von-Exchange-Online-zu-Gmail-migrieren-10443923.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/CloudComputing" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudComputing</a> <a href="https://social.heise.de/tags/EMail" class="mention hashtag" rel="nofollow noopener" target="_blank">#EMail</a> <a href="https://social.heise.de/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#Google</a> <a href="https://social.heise.de/tags/IT" class="mention hashtag" rel="nofollow noopener" target="_blank">#IT</a> <a href="https://social.heise.de/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> <a href="https://social.heise.de/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a> <a href="https://social.heise.de/tags/OfficeSuite" class="mention hashtag" rel="nofollow noopener" target="_blank">#OfficeSuite</a> <a href="https://social.heise.de/tags/Systemverwaltung" class="mention hashtag" rel="nofollow noopener" target="_blank">#Systemverwaltung</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a>

ESET Research<a href="https://infosec.exchange/tags/ESETresearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#ESETresearch</a> analyzed a campaign deployed by BladedFeline, an Iran-aligned threat actor with likely ties to <a href="https://infosec.exchange/tags/OilRig" class="mention hashtag" rel="nofollow noopener" target="_blank">#OilRig</a>. We discovered the campaign, which targeted Kurdish and Iraqi government officials, in 2024. <a href="https://www.welivesecurity.com/en/eset-research/bladedfeline-whispering-dark/" rel="nofollow noopener" translate="no" target="_blank">https://www.welivesecurity.com/en/eset-research/bladedfeline-whispering-dark/</a> BladedFeline, a cyberespionage group active since at least 2017, develops malware for strategic access within the Kurdistan Regional Government and the government of Iraq. We discovered BladedFeline in 2023 after it targeted Kurdish officials with the <a href="https://infosec.exchange/tags/Shahmaran" class="mention hashtag" rel="nofollow noopener" target="_blank">#Shahmaran</a> backdoor. The systems compromised in the latest campaign contained the <a href="https://infosec.exchange/tags/Whisper" class="mention hashtag" rel="nofollow noopener" target="_blank">#Whisper</a> backdoor, a malicious IIS module <a href="https://infosec.exchange/tags/PrimeCache" class="mention hashtag" rel="nofollow noopener" target="_blank">#PrimeCache</a>, two reverse tunnels, and several supplementary tools. Whisper uses <a href="https://infosec.exchange/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a> server to communicate with the attackers via email attachments. We believe with medium confidence that BladedFeline is a subgroup of OilRig, an 🇮🇷-based APT group also known as APT34 or Hazel Sandstorm. First, there were OilRig tools present in the systems compromised in this campaign. BladedFeline’s PrimeCache also shares code similarities with OilRig’s <a href="https://infosec.exchange/tags/RDAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#RDAT</a> backdoor. Moreover, as does OilRig, BladedFeline targets organizations in the Middle East. IoCs will be available in our GitHub repo: <a href="https://github.com/eset/malware-ioc/tree/master/" rel="nofollow noopener" translate="no" target="_blank">https://github.com/eset/malware-ioc/tree/master/</a>

CybersecKyleUS indicts Black Kingdom ransomware admin for Microsoft Exchange attacks <a href="https://www.bleepingcomputer.com/news/security/us-indicts-black-kingdom-ransomware-admin-for-microsoft-exchange-attacks/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Social-Pipeline" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/us-indicts-black-kingdom-ransomware-admin-for-microsoft-exchange-attacks/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Social-Pipeline</a><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/cybersec" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersec</a> <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#ransomware</a> <a href="https://infosec.exchange/tags/microsoftexchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#microsoftexchange</a>

Kevin Karhan :verified:rant, Nextcloud

heise onlineMicrosoft erhöht Preise für On-Premises-ServerMicrosoft erkennt an, dass es Kunden gibt, die On-Premises-Installationen benötigen. Die sollen dafür aber tiefer in die Tasche greifen.<a href="https://www.heise.de/news/Microsoft-erhoeht-Preise-fuer-On-Premises-Server-10345544.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/Microsoft-erhoeht-Preise-fuer-On-Premises-Server-10345544.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a> <a href="https://social.heise.de/tags/IT" class="mention hashtag" rel="nofollow noopener" target="_blank">#IT</a> <a href="https://social.heise.de/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> <a href="https://social.heise.de/tags/Server" class="mention hashtag" rel="nofollow noopener" target="_blank">#Server</a> <a href="https://social.heise.de/tags/SharePoint" class="mention hashtag" rel="nofollow noopener" target="_blank">#SharePoint</a> <a href="https://social.heise.de/tags/Wirtschaft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wirtschaft</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a>

Kevin Karhan :verified:<a href="https://netzsphaere.xyz/users/maija" class="u-url mention" rel="nofollow noopener" target="_blank">@maija</a> worse is <a href="https://infosec.space/tags/MAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#MAPI</a> which solely exost to enshure <a href="https://mastodon.online/@thunderbird" class="u-url mention" rel="nofollow noopener" target="_blank">@thunderbird</a> can't work with <a href="https://infosec.space/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a> out of the box!<a href="https://en.wikipedia.org/wiki/MAPI" rel="nofollow noopener" translate="no" target="_blank">https://en.wikipedia.org/wiki/MAPI</a>

Kevin Karhan :verified:<a href="https://wisskomm.social/@DigA_UniLeipzig" class="u-url mention" rel="nofollow noopener" target="_blank">@DigA_UniLeipzig</a> alles ist besser als <a href="https://infosec.space/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a>: Selbst nen alter <a href="https://infosec.space/tags/UltraSPARC" class="mention hashtag" rel="nofollow noopener" target="_blank">#UltraSPARC</a>-T2 mit <a href="https://infosec.space/tags/Solaris" class="mention hashtag" rel="nofollow noopener" target="_blank">#Solaris</a> sowie <a href="https://infosec.space/tags/Postfix" class="mention hashtag" rel="nofollow noopener" target="_blank">#Postfix</a> & <a href="https://infosec.space/tags/Courierist" class="mention hashtag" rel="nofollow noopener" target="_blank">#Courierist</a> besser, weils nativ mit allen Clients.wie <a href="https://mastodon.online/@thunderbird" class="u-url mention" rel="nofollow noopener" target="_blank">@thunderbird</a> funktioniert.

Kevin Karhan :verified:<a href="https://pixelfed.social/heinelo" class="u-url mention" rel="nofollow noopener" target="_blank">@heinelo</a> genau das sehe ich fundamental andersherum, eben weil jene <a href="https://infosec.space/tags/Monokultur" class="mention hashtag" rel="nofollow noopener" target="_blank">#Monokultur</a> ein Problem ist, sollten Leute umso mehr an offene Standards gewohnt werden.<a href="https://infosec.space/tags/MicrosoftOffice" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftOffice</a> kann problemlos <a href="https://infosec.space/tags/OpenDocument" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenDocument</a> verarbeiten, aber <a href="https://infosec.space/tags/OOXML" class="mention hashtag" rel="nofollow noopener" target="_blank">#OOXML</a> ist bewusst so designed dass es faktisch unmöglich ist dies sauber zu implementieren!<ul><li>Dasselbe gibt auch bei anderen Standards wie <a href="https://infosec.space/tags/IMAP" class="mention hashtag" rel="nofollow noopener" target="_blank">#IMAP</a> vs. <a href="https://infosec.space/tags/MAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#MAPI</a> / <a href="https://infosec.space/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a>... </li></ul>Wäre was anderes wenn Mensch zu "Fachsoftware" fenötigt wird wie :würg: SAP oder :kotz: DATEV...

Scripter :verified_flashing:Microsoft ist ein Risiko für die nationale Sicherheit <a href="https://tarnkappe.info/artikel/it-sicherheit/ehemaliger-direktor-im-weissen-haus-microsoft-ist-eine-bedrohung-fuer-die-nationale-sicherheit-292479.html" rel="nofollow noopener" translate="no" target="_blank">https://tarnkappe.info/artikel/it-sicherheit/ehemaliger-direktor-im-weissen-haus-microsoft-ist-eine-bedrohung-fuer-die-nationale-sicherheit-292479.html</a> <a href="https://social.tchncs.de/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> <a href="https://social.tchncs.de/tags/Mailserver" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mailserver</a> <a href="https://social.tchncs.de/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a>

IT NewsMicrosoft blamed for “a cascade of security failures” in Exchange breach report - Enlarge (credit: Getty Images) A federal Cyber Safety Review B... - <a href="https://arstechnica.com/?p=2014535" rel="nofollow noopener" translate="no" target="_blank">https://arstechnica.com/?p=2014535</a> <a href="https://schleuss.online/tags/nation" class="mention hashtag" rel="nofollow noopener" target="_blank">#nation</a>-stateactors <a href="https://schleuss.online/tags/microsoftexchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#microsoftexchange</a> <a href="https://schleuss.online/tags/microsoftazure" class="mention hashtag" rel="nofollow noopener" target="_blank">#microsoftazure</a> <a href="https://schleuss.online/tags/auditlogging" class="mention hashtag" rel="nofollow noopener" target="_blank">#auditlogging</a> <a href="https://schleuss.online/tags/storm" class="mention hashtag" rel="nofollow noopener" target="_blank">#storm</a>-0558 <a href="https://schleuss.online/tags/crashdump" class="mention hashtag" rel="nofollow noopener" target="_blank">#crashdump</a> <a href="https://schleuss.online/tags/microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#microsoft</a> <a href="https://schleuss.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://schleuss.online/tags/biz" class="mention hashtag" rel="nofollow noopener" target="_blank">#biz</a>⁢ <a href="https://schleuss.online/tags/china" class="mention hashtag" rel="nofollow noopener" target="_blank">#china</a> <a href="https://schleuss.online/tags/cisa" class="mention hashtag" rel="nofollow noopener" target="_blank">#cisa</a> <a href="https://schleuss.online/tags/csrb" class="mention hashtag" rel="nofollow noopener" target="_blank">#csrb</a>

Matt WillemsenMicrosoft Exchange vulnerability actively exploited <a href="https://www.malwarebytes.com/blog/news/2024/02/microsoft-exchange-vulnerability-actively-exploited" rel="nofollow noopener" translate="no" target="_blank">https://www.malwarebytes.com/blog/news/2024/02/microsoft-exchange-vulnerability-actively-exploited</a> <a href="https://mastodon.social/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a> <a href="https://mastodon.social/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://mastodon.social/tags/exploit" class="mention hashtag" rel="nofollow noopener" target="_blank">#exploit</a> <a href="https://mastodon.social/tags/PatchTuesday" class="mention hashtag" rel="nofollow noopener" target="_blank">#PatchTuesday</a> <a href="https://mastodon.social/tags/BSI" class="mention hashtag" rel="nofollow noopener" target="_blank">#BSI</a> <a href="https://mastodon.social/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE</a> <a href="https://mastodon.social/tags/leaked" class="mention hashtag" rel="nofollow noopener" target="_blank">#leaked</a> <a href="https://mastodon.social/tags/NTLM" class="mention hashtag" rel="nofollow noopener" target="_blank">#NTLM</a> <a href="https://mastodon.social/tags/credentials" class="mention hashtag" rel="nofollow noopener" target="_blank">#credentials</a>

stux⚡What is the Cyber Trust Mark? & Major ColdFusion & Microsoft Exchange Hacks Underway! <a href="https://mstdn.social/tags/ThreatWire" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatWire</a> <a href="https://mstdn.social/tags/Hak5" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hak5</a> <a href="https://mstdn.social/tags/ColdFusion" class="mention hashtag" rel="nofollow noopener" target="_blank">#ColdFusion</a> <a href="https://mstdn.social/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a><a href="https://www.youtube.com/watch?v=yoVkxZ8JRcQ" rel="nofollow noopener" target="_blank">https://www.youtube.com/watch?v=yoVkxZ8JRcQ</a>

Jonathan BlackshireAny <a href="https://zirk.us/tags/MicrosoftExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftExchange</a> experts out there? I'm about to slam my head through my desk.

Andrew BakerTime for an second introduction, now I’ve moved over to a new instance. My name is Andrew, and I’m an Senior Infrastructure Officer in Local Government in the South West of the UK. I mainly work with <a href="https://msto.andrewbaker.uk/tags/memcm" class="mention hashtag" rel="nofollow noopener" target="_blank">#memcm</a>, <a href="https://msto.andrewbaker.uk/tags/microsoftteams" class="mention hashtag" rel="nofollow noopener" target="_blank">#microsoftteams</a>, <a href="https://msto.andrewbaker.uk/tags/microsoftexchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#microsoftexchange</a> and other services to support my workplace.I’ve been slowly working my way away towards Linux for home use and have fully converted all of my devices to <a href="https://msto.andrewbaker.uk/tags/fedora" class="mention hashtag" rel="nofollow noopener" target="_blank">#fedora</a> (apart from the <a href="https://msto.andrewbaker.uk/tags/SteamDeck" class="mention hashtag" rel="nofollow noopener" target="_blank">#SteamDeck</a> ;) )I’ve got interests in <a href="https://msto.andrewbaker.uk/tags/gaming" class="mention hashtag" rel="nofollow noopener" target="_blank">#gaming</a>, <a href="https://msto.andrewbaker.uk/tags/photography" class="mention hashtag" rel="nofollow noopener" target="_blank">#photography</a>, and <a href="https://msto.andrewbaker.uk/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a>.

Recent searches

Search options

Administered by:

Server stats:

#microsoftexchange