Skip to main content
عربي
logo

NCSC-TAD-2405-001

Severity Level: Low
Malware

Reference No.: NCSC-TAD-2405-001CVSS 0

Keylogger Embedded in Microsoft Exchange Server Steals Login Credentials

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

Threat actors were observed compromising Microsoft Exchange Server environments and implanting a server-side keylogger designed to capture user login credentials. The malware was embedded within the Exchange server infrastructure and monitored authentication activity to harvest usernames and passwords entered through web-based login portals. By collecting valid credentials directly from the server, attackers could gain unauthorized access to email accounts, establish persistence, conduct account compromise, and potentially facilitate further intrusion activities within affected organizations. The campaign demonstrates the continued targeting of internet-facing email infrastructure as a source of sensitive credentials.

Affected Technologies

  • Microsoft Exchange Server

Mitigation and Immediate Actions

  1. 01

    Isolate and investigate affected Exchange servers for unauthorized modifications and malicious files.

  2. 02

    Reset credentials for users who authenticated through potentially compromised systems.

  3. 03

    Inspect Exchange and IIS directories for unknown scripts, web shells, or keylogging components.

  4. 04

    Review authentication logs for suspicious login activity and unauthorized access.

  5. 05

    Apply the latest Microsoft Exchange security updates and security hardening recommendations.

  6. 06

    Enable multifactor authentication (MFA) for all externally accessible accounts.

  7. 07

    Monitor for unusual mailbox access, credential abuse, and privilege escalation attempts.

References