Exchange Server Vulnerability - Still Having Issues after all Patch and CU20 Updates

JSS CGY 1 Reputation point
2021-04-28T22:03:41.617+00:00

Hello everyone,

As per Microsoft Recommendations, we already installed all security patches earlier in the March and installed CU 20 updates. Here are the details about our issues. Any help on this will be appreciated:

Issue: High CPU utilization due to cmd.exe process

Exchange 2016 Standard

Work done so far:
All patches installed, CU 20 installed, Performed multiple scan with Microsoft Safety Scanner, every time it finds and remove "Backdoor:MSIL/Chopper.F!dha " but next day same issue occurs

Opened CMD.exe file with process explorer today and found following scripts:
C:\Windows\System32\cmd.exe -o 95.216.46.125:443 -u 44EspGiviPdeZSZyX1r3R9RhpGCkxYACEKUwbA4Gp6cVCzyiNeB21STWYsJZYZeZt63JaUn8CVxDeWWGs3f6XNxGPtSuUEX -k --tls -p MOON

Also ran Exchange Mitigation Tool and it did not found anything.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,359 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,729 questions

9 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Behnam 1 Reputation point
    2021-09-09T10:03:34.14+00:00

    **** P.S. I just want to confirm that after almost a week no infections are detected by MSERT and Defender. So I can say the malware doesn't REGENERATE itself everyday but the server is BEING ATTACKED every single day. If you block the attack source you can survive for now.

    Same problem here on a fully updated Windows 2019 running Exchange 2019 CU10.

    But since this malware is related to attacks originating from China, I tried to limit access to port 443 only to domestic IP addresses on my firewall and so far infections have not come back in the last 24 hours :)

    Since we have no users based abroad it worked as a feasible temporary workaround for me.

    Will wait for future MS updates...

  2. Cesar 41 Reputation points
    2021-09-14T20:58:08.383+00:00

    Hi,

    Last week, users started noticing 'draft' emails they never created containing attachments. I ran MSERT and it found the two infections below:

    Backdoor:MSIL/Chopper.F!dha
    Backdoor:ASP/WebShell.C!MTB

    Rebooted the server and no more infections found. I ran MSERT a few times since then and no infections found.

    Today, users reported 'draft' emails appearing again. Ran the MSERT and it found the same infections.

    At this point, I am not sure what else to do. By the way, I have Malware bytes installed and it did not detect it at all.

    Any help will be greatly appreciated.
    Thank you

    Server 2019 STD
    Exchange 2019
    Fully patched and updated

  3. Behnam 1 Reputation point
    2021-09-15T16:42:48.323+00:00

    I just want to confirm that after almost a week no infections are detected by MSERT and Defender. So I can say the malware doesn't REGENERATE itself everyday but the server is BEING ATTACKED every single day. If you block the attack source you can survive for now.

  4. Greg Dimaandal 6 Reputation points
    2021-09-17T19:13:03.087+00:00

    Exchange Server 2016 CU21 fully patch
    -We got the same issue on our server when it was running CU14 and their on premise IT didn't notice or check until user complain about the Drafts email issue. When I check on the Admin account its been creating malicious draft email for a month already. Good think no one had opened the attachment.\

    2 Days after upgrading to CU21 and installing the July Patch. No one has complain yet for the same issue. so I hope it fixes the issue.