????????? ???????? ? ?????? ????? ?????? ????? ???? ????? ?? ??????? Exchange ???? ???? ????????? ?? ?? ????? ???? ????? ?? ?????? ?????? ??? ?? ???? ?????? ??? ??????? ??? ????.
?? ???? ????? ????????[?]? ?????? ???????? ?? ??????? ??????????? ????? ProxyLogon Exchange Server ???? ??? ?? ????????? ???? ?? ??? “DearCry” ??????? ???????.
????? ?????? ???? ?????????? ?? ?????? ??? ????[?]: “?????????? ??????? ????? ?? ????? ?????????? ?? ?? ???? ????? ????? ?????? ?????? ??? ?? ???????? Ransom: Win32/DoejoCrypt.A ??????? ????. ??? ????? ??? ?????? ???? ????? ?? ?????????????? Microsoft Exchange ???? ??????????? ?? ??????? ??????? ??????.”
??? ??????? ?????? ??????????? ?? ?????? ??????? ????? ???[?] ?? “????? ???? ??????? ????? ?? ??????????? ?? ?? ?? ?? ??? ?????? ??????? ??????? Exchange ???? ???? ?? ???” ???? ???? ???.
???? ?????? Kryptos Logic ????? ???[?] ?? ???? ????? ??????? ??? ?? ?? ??????? ???? ??? ?? ???? ?? ????? ???? ????? ???? ??????? ????????? ?? ????????? DearCry ??????????? ????????????? ? ??? ???? ?????? ?? ???? ???????? ?????? ?????? ?? ????? ??????? ??????? ?? ?? ???? Hafnium ???? ???? ??? ???? ??????? ????? ?? ?? ?????? ?????? ??? ???????.
???? ?????? ???? Sophos ?? ?? DearCry ???????? ??? ????? “copy” ??? ??????? ???[?] ?? ??? ??? ?? ??????? ?? ?? ???? ???????? ?? ?? ?????? ??? ????? ????? ??? ???? ???????? ???????? ?????? ?? ?????????? ???????? ????? ?????? ? ???????? ???? ?? ??? ??????? ??? ????? ???????? ??????? ?? ???????? ????? ?????? “?????? ?????? ???? ?? ??????? ?? ??????? ????”.
Loman ???: “??????? ???? ???? ??? ???????? ?????????? ??????? ???? ????? ???? ?? ?? ??????????? ?? ???????? Microsoft Exchange ??? ??????? ????. ??? ??? ????? ???? ?????? ???? ????????? ???? ?? ??????? ??? ??? ?? ???? ??? ?????? ?? ????? ????? ???.”
?? ????? ????????[?] ???? ????? ????? ?????? ? ??????????? ???????????? (CISA) ? ????? ??????? ????? (FBI)? ??? ????????? ????? ????? ?? “?????? ????????? ?? ??? ????????????? ???? ?? ??? ??????? ???????? ???? ???????? ???????? ??????? ???? ??? ?? ??? ?????????? ?? ???? ?????? ??????? ????.”
????????? ??????????? ?? ??? ?????? ?? ????? ????? ?????? ?? ?? ??????? Exchange ???????? ?????? ???? ??? ? ????? ?? ???? ??????? ?? ?? ????? ?????? ????? ????? ? ????? ?? ???? ??????? ?? ?? ??? ?????. ?? ??? ????? ???? ??? ?????? ??????? ???? ???? ??????? ?? ???? ??? ???? ??????? ??????? ?????? ???? ?????? ?????? ???????? ??????? ? ?? ?????? ?? ????????? ???? ?????? ??????? ???????.
??????? ??? PoC ?? GitHub ???? ??? ???? ?????? ?????? ??.
?? ???? ???? ????????? ?????? ???????? ??? ? ?????? ?????? ???? ??????? ?? ????? ProxyLogon ?? ????????? ?? ?? ????? ???? (PoC) ?? ???? ?? ???? ?????? ?? GitHub ????? ?? ?????????? ?? ?????? ?????? ???? ???? ??? ???? ??? ??? ??? ?? ???? ?????? ??? ??????????? ??? ?????? ???? ???.
?? ????????? ?? Vice? ??? ???? ?????????? ???[?]: “??? ????????? ??? ????[?]? ?? ?? ??? ?????????? ?? ???? ????? ?? ???? ???? ?????????? ?????? ??? ??? ??? ? ?????? ???? ???? ??????????? ???? ??????? ?? ??????? ?????.”
??? ????? ?????? ???? ????????? ??? ???????? ??? ??? ? ?? ?????? ??????? ?????????? ?? ??? PoC ??? ?? ?????? ?????????? ?? GitHub ?????? ?????? ?? ???? ??????.
??? ???? ?? TrustedSec ?????????? ???: “??? ????? ????? ???? ???? ??? ?? ?????? ?????? ?? GitHub ???? ????? ?????? ?? ?? ??? ???? ???? ??? ???. ??? ?? PoC ???? ?? ?? ??????????? ???? ? ?????? ?? PoC ?? RCE ??????????. ??? ??? ?? ????? ????? ??? ????? ????? ?? ??????? ????? ???? ?? ???? ????? ???? ?????? ?? ??? ????? ??? ?? ??. ??? ????? ?? ????? ?????? ??? ? ????? ?????? ?????? ?? ?? ???? ?? ???? ?????.”
??? ???? ?? Tavis Normandy ?? ???? ?????? Google Project Zero ???? ??? ????? ???.
Normandy ?? ?????? ???: “??? ????? ?? ????? PoC/metasploit/etc ????? ??? ????? ????? ???? ????? ??? ??? ????? ????? ???. ?? ??? ????? ????? ????? ? ???? ?? ?? ?????????? ???? ???????????? ?? ???? ???????? ????? ????? ??? ???? ????? ??? ?? ???????? ???? ???? “?????” ??? ?????? ????????. ???? ????!”
??? ?????? ??????? ???? ?????? ?? ???? ?? ???? ?? ?????? ???: “??? ?? ?????? ???? Exchange ???? ???? ???? ????. ???? ???? ?? ?????? ???? ????? RCE ?? ????? ?????? ????? ???? ?????????? ? ??????? ???.”
????????? ??? ????? ???? ?????? ???? ???? ?? ?? ??????? ???????? Exchange Server ????. ????????? ?? ???? ?? ????? ??????? ?? ??? ?????????????? ??? ??? ?? ??? ??????? ????? ?? ??? ??? ?? ????? ?????????? ??????? ?? ?? ? ???? ????? ???? ??????????? ?????? ????? ????? ?? ?? ???? ???? ???? ????? ??????? ??? ?? ??? ?????? ???? ????? ????.
?????
[?] https://twitter.com/demonslay335/status/1370125343571509250
[?] https://twitter.com/phillip_misner/status/1370197696280027136
[?] https://twitter.com/MsftSecIntel/status/1370236539427459076
[?] https://twitter.com/kryptoslogic/status/1370478455817637895
[?] https://twitter.com/SophosLabs/status/1370477406696271875
[?] https://thehackernews.com/2021/03/proxylogon-exchange-poc-exploit.html
[?] https://www.vice.com/en/article/n7vpaz/researcher-publishes-code-to-exploit-microsoft-exchange-vulnerabilities-on-github
[?] https://docs.github.com/en/github/site-policy/github-acceptable-use-policies#2-content-restrictions
[?] https://thehackernews.com/2021/03/icrosoft-exchange-ransomware.html
??????? :
???? ??????
