Exchange Servers Suffer as “DearCry” Ransomware Spreads

A crying shame for on-site servers as hackers this month (March 2021) exploited their vulnerabilities on a grand scale.

The ticking time bomb of on-site servers has gone off for tens of thousands as cyber-criminal gangs have gained entry into thousands of on-site servers.

They have implanted a new strain of ransomware, named DearCry, targeting vulnerable victims who have yet to or are unable to apply the advised patches to their exchange servers, due to what is known as “Zero” day.

A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who should be interested in mitigating the vulnerability of the target software). Until the vulnerability is mitigated, hackers can exploit it to adversely affect computer programs, data, additional computers or a network.

There are around 80,000 older servers that cannot apply Microsoft’s recent security updates directly and have not been patched, down an initial 400,000 unpatched servers observed on March 1^st.

DearCry itself – which has now surfaced, appears a reasonably run-of-the-mill ransomware, but notably appears to contain no flaws that would enable victims to decrypt their data without payment.

A demand for over £11,000 was made to one victim for their data to be decrypted. However, this request is not enough to determine if £11,000 is the “market price” for DearCry attacks, or if they’re asking for even larger amounts.  However other ransomware groups will happily charge you greater sums,

We urge organisations running all versions of Exchange to assume they were compromised before they patched their systems, because it is now known that attackers were exploiting these zero-day vulnerabilities in the wild for at least two months before Microsoft released the patches on March 2^nd, 2021.

Some cybergangs gather terabytes of OSINT intelligence about Internet software, and once there is a zero-day, they sell compiled lists of IP addresses or URLs known to run the vulnerable software to other gangs.

If you have a backup plan to restore the files, you can choose to ignore the attackers and carry on as usual. Nevertheless, copies of the compromised files may still remain in the hands of the hackers and could be leaked.

All organisations are strongly advised to apply the patches as soon as possible and to create offline backups of their Exchange servers, and put a disaster recovery plan in place.

A safer option is always to migrate your on-premises server to cloud with Microsoft, it not only offers a much higher level of security than most vendors can give provide your server with by far and at fraction of the cost to have peace of mind and bullet proof security but also is much less expensive than the running of maintenance costs, software and hardware and security costs for your own server.

It is extremely important to defend your business against advanced cyberthreats from sophisticated ransomware attacks. Control access to sensitive information, keep data from being accidentally or purposely shared, and Microsoft cloud services provide superior security in order for you to achieve this.

Find an official Microsoft partner in Gibraltar such as ITMS who have a tracked record of nearly 20 years servicing and securing Gibraltar’s organisations to protect their future. We will always answer your cry’s for help!

If you need help or think your server has been compromised and or need to migrate your data to the cloud with an official Microsoft Partner in Gibraltar Contact Us

Microsoft 365 Apps for business includes:

Microsoft’s Office has been a staple for businesses for many years and that’s not about to change. Office 365 is the name for the package which includes the suite of Microsoft’s core programs as well as a cloud service, letting you stay connected wherever you are. But why should you switch to it? And what benefits can it bring to your business? Here’s a collection of features in Office 365 which can change the way you work and that have the potential to overhaul your business workflow.

Gain access to the latest software versions

With an active Office 365 for Business subscription, you gain access to the latest versions of the Office suite via regular and free updates. These updates include bug fixes, security patches, performance improvements and new features that add additional functionality to your software. A one-time purchase of Office doesn’t come with these benefits. And to gain access to an updated version of the package it must be purchased again.

Contains the whole Office Suite and more

Depending on your plan, an Office 365 subscription gives you a variety of useful programs on top of the basics of Word, Excel, PowerPoint, Publisher and Outlook. Programs like Teams let you set up a chat with co-workers, enabling working on the go from multiple locations. OneNote lets you type, draw and write down ideas then share them between devices. Skype for Business lets you set up video calls with clients and co-workers. And SharePoint lets you collaborate on files with co-workers using the cloud.

Cloud-based storage means access from anywhere

Because Office 365 is powered by the cloud it means all your programs and files can be accessed from anywhere that has an internet connection. This enables you to work from wherever you like and still have access to the full range of tools you need. Furthermore, using OneDrive (Office 365’s cloud storage solution) means you can view and edit important files from home, work, or even over Wi-Fi.