Microsoft Exchange servers are being hacked to deploy ransomware

Every ransomware attack starts with a compromised endpoint, and to that end, threat actors have now started looking into Microsoft Exchange servers. As per a report (opens in new tab) published by the Microsoft 365 Defender Threat Intelligence Team, at least one unpatched and vulnerable server (opens in new tab) was targeted by crooks, and abused to gain access to the target network.

After gaining a foothold, the threat actors lurked around, mapping out the network, stealing credentials, and pulling out data to be later used in a double extortion attack.