Kremlinハッカーが最大深刻度のExchangeサーバー脆弱性を悪用中Max-severity Exchange server flaw under active exploitation by Kremlin hackers

Russian state-linked hackers are actively exploiting a maximum-severity vulnerability in Microsoft Exchange servers, according to reporting from Ars Technica. The campaign matters because the exploits reportedly allow attackers to establish persistent access that survives standard remediation steps such as credential rotation and full disk re-imaging, leaving organizations that have not applied fixes at acute risk.

The core concern is the durability of the compromise. Under normal incident-response practice, defenders assume that rotating passwords and rebuilding a server from a clean image will evict an intruder. In this case, the persistence mechanism appears to defeat both of those measures, meaning administrators who believe they have cleaned an affected system may in fact still be exposed. This kind of resilience typically implies that attackers are capturing secrets or planting footholds that live outside the operating system disk, so a routine wipe-and-restore does not remove them.

Attributing activity to Kremlin-linked operators places this campaign in a well-documented pattern. Groups associated with Russian intelligence services, often tracked under names such as APT28 and APT29 (also called Fancy Bear and Cozy Bear, with the latter identified by Microsoft as Midnight Blizzard), have repeatedly targeted email infrastructure. Mail servers are attractive because they hold sensitive correspondence, act as identity hubs, and frequently sit at the boundary between internal networks and the public internet, making them a springboard for deeper intrusion.

Exchange has a long history as a high-value target. In 2021, the ProxyLogon and ProxyShell vulnerability chains were exploited at scale, affecting tens of thousands of on-premises servers worldwide and prompting emergency patches and government advisories. Those incidents established a template that is relevant here: a critical flaw in a widely deployed, internet-facing product, followed by rapid, opportunistic exploitation before organizations can patch. The recurrence of maximum-severity issues in on-premises Exchange has been a key argument Microsoft and security agencies have used to push customers toward its cloud-hosted Exchange Online service, where patching is handled centrally.

A maximum-severity rating, usually expressed as a CVSS score at or near 10.0, generally indicates that a flaw can be exploited remotely, requires little or no authentication, and yields significant control over the affected system. When such conditions are combined with active in-the-wild exploitation, the practical window for defenders is short. Patching alone may also be insufficient if attackers gained access before fixes were applied, because any credentials, tokens, or cryptographic material they harvested could enable them to return. That dynamic is consistent with the report's emphasis that access can outlast credential resets.

For organizations running on-premises Exchange, the prudent response follows established guidance for serious server compromises. Applying the vendor's security updates is the necessary first step, but administrators are also likely to need to treat potentially affected servers as fully compromised: hunting for indicators of compromise, reviewing logs for unauthorized activity, and rotating not just user passwords but also machine-level secrets and any keys that could permit re-entry. Isolating internet-facing Exchange servers, restricting management interfaces, and validating backups are commonly recommended precautions in situations like this.

The broader context is a continued focus by state-sponsored actors on identity and communication systems. Recent years have seen Russian-linked groups implicated in intrusions targeting email and cloud accounts of governments, corporations, and technology vendors themselves. Persistent access to a mail server can facilitate espionage, lateral movement, and the theft of authentication data that unlocks connected cloud services, amplifying the impact well beyond a single machine.

At the time of reporting, the practical takeaway is that unpatched, internet-exposed Exchange deployments should be considered a priority for immediate attention. Defenders who have already patched but cannot rule out earlier exposure would be wise to assume a breach may have occurred and to verify integrity rather than rely on remediation steps that this campaign appears designed to survive. Security agencies such as the U.S. Cybersecurity and Infrastructure Security Agency have historically issued directives during comparable Exchange events, and organizations should watch for official advisories that may specify affected versions, indicators, and required mitigations as more details become available.