Australia markets open in 7 hours 35 minutes
  • ALL ORDS

    7,258.90
    -23.20 (-0.32%)
     
  • AUD/USD

    0.7753
    +0.0024 (+0.32%)
     
  • ASX 200

    6,997.50
    -20.30 (-0.29%)
     
  • OIL

    62.01
    -0.66 (-1.05%)
     
  • GOLD

    1,793.80
    +15.40 (+0.87%)
     
  • BTC-AUD

    72,425.54
    +956.34 (+1.34%)
     
  • CMC Crypto 200

    1,295.04
    +32.08 (+2.54%)
     

Microsoft detects, blocks new wave of security threats

Bloomberg
·2-min read
NEW YORK, NEW YORK - MARCH 10: View of a Microsoft store on March 10, 2021, in New York. The Nasdaq Composite continued falling more than half a percent during the day. Also, the move away from Apple Inc, Amazon.com Inc , Facebook Inc, Tesla Inc and Microsoft Corp, falling during the day, helped small-cap stocks rise more than double the gains of the S&P 500. (Photo by John Smith/VIEWpress)
Microsoft has detected and blocked another wave of security threats attacking still-vulnerable servers. (Photo by John Smith/VIEWpress)

Microsoft (NASDAQ: MSFT) has detected and blocked a “new family of ransomware” that was being used against servers that still hadn’t patched vulnerabilities after last week’s major security breach.

The updates it released on Friday are a temporary measure to defend against attacks, which were already occurring in many places, the company said.

The company discovered suspected Chinese state-sponsored hackers were exploiting previously unknown vulnerabilities in Microsoft’s widely used Exchange business email software earlier in March.

Even as it issued a patch for those systems, hackers rushed to find companies that had yet to install Microsoft’s fix.

BitSight Technologies, a Boston-based cybersecurity firm, said that based on internet-wide scans it had done this week nearly one-third of vulnerable Microsoft Exchange customers have yet to patch their systems.

Those customers would are now also vulnerable to the new ransomware attacks until those patches are installed.

WATCH ABOVE: White House describes Microsoft cyber hack as 'significant'

Hackers are using the weaknesses introduced in the original attacks, including secret entry points inserted in victims’ systems, to gain access.

Governments have been hounding businesses to install the patches — the Australian government has issued at least three warnings in nine days — and Microsoft has warned organisations to take urgent action to forestall damage.

This latest update “means that Microsoft is concerned that people haven’t patched,” said Robert Potter, a cybersecurity expert based in Canberra, Australia.

“If you’ve already been hit there’s very little you can do. You better hope your backups work, because you’re not going to get decrypted.”

Ransomware targets so far have been small to medium-sized organisations victimised by hackers using relatively simple malware dubbed DOJOCRYPT or DearCry, said Kimberly Goody, senior manager of cybercrime analysis at Mandiant Threat Intelligence. Small companies are less likely to have dedicated IT staff to install patches immediately.

The network monitoring firm RiskIQ, working closely with Microsoft, says the number of vulnerable Exchange servers has plummeted in the last 10 days, from hundreds of thousands down to about 83,000.

But their data analysis also shows that networks for banks, health care and pharmaceutical institutions remain vulnerable, as do systems for federal, state and local governments.

“If SolarWinds was a tactical missile strike, this one was a nuclear bomb,” said Elias Manousos, CEO and founder of RiskIQ. “Attackers are just trying to create as much chaos as possible.”

—with Bloomberg

Follow Yahoo Finance on Facebook, LinkedIn, Instagram and Twitter, and subscribe to the free Fully Briefed daily newsletter.