{"id":56425,"date":"2024-01-29T09:30:00","date_gmt":"2024-01-29T09:30:00","guid":{"rendered":"https:\/\/infrasos.com\/?p=56425"},"modified":"2024-01-24T17:14:07","modified_gmt":"2024-01-24T17:14:07","slug":"recent-cyber-threats-targeting-microsoft-exchange-server","status":"publish","type":"post","link":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/","title":{"rendered":"Recent Cyber Threats Targeting Microsoft Exchange Server"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"56425\" class=\"elementor elementor-56425\">\n\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ff70a3e e-con-boxed e-con\" data-id=\"ff70a3e\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-63ee1be elementor-widget elementor-widget-text-editor\" data-id=\"63ee1be\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">Recent Cyber Threats Targeting Microsoft Exchange Server. Microsoft <a href=\"https:\/\/infrasos.com\/how-to-migrate-mailboxes-from-exchange-to-office-365\/\">Exchange<\/a> servers remain a prime focus for threat actors, as evidenced by the sustained targeting they endure. Despite the migration of some businesses to cloud services like O365, Exchange on-premise continues to have a large presence amongst publicly exposed services. Unlike standard web applications, Exchange requires a lot more than just port 443 (https). For most, legacy ports are still in use (IMAP, POP3), thus creating a larger attack surface. Whilst <a href=\"https:\/\/infrasos.com\/top-10-best-ways-to-prevent-cyber-attacks-on-businesses\/\">attackers continue to develop intelligent, or unseen exploits<\/a>, patterns are often shared.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">This article covers methods of mitigating attackers, and how you keep your Exchange Servers safe. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-33e0307 elementor-widget elementor-widget-text-editor\" data-id=\"33e0307\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/exchange-server-2019-monitoring-best-practices\/\">Exchange Server 2019 Monitoring Best Practices<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-feb5ed4 elementor-widget elementor-widget-heading\" data-id=\"feb5ed4\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-default\">Finding Exchange Servers<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-84ed731 elementor-widget elementor-widget-text-editor\" data-id=\"84ed731\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Before we dive in, it\u2019s important to know how easy an attacker can find Exchange services and few methods how they find their victims.<\/span><\/p><p><span style=\"font-weight: 400;\">Shodan, is a famous search engine that scans the internet, allowing users to browse through discovered services. By using Shodan, we view the map of Exchange Servers today:<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-932ec49 elementor-widget elementor-widget-image\" data-id=\"932ec49\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Screenshot-2024-01-18-at-19.57.57.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Recent Cyber Threats Targeting Microsoft Exchange Server\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTY0MjcsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjRcLzAxXC9TY3JlZW5zaG90LTIwMjQtMDEtMTgtYXQtMTkuNTcuNTcucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Screenshot-2024-01-18-at-19.57.57-qiic49je2xoug5rfxn4t2v15ic8dqa82ukfkzmgyco.png\" title=\"Recent Cyber Threats Targeting Microsoft Exchange Server\" alt=\"Recent Cyber Threats Targeting Microsoft Exchange Server\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\">Exchange Report: Shodan.io<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-28258c2 elementor-widget elementor-widget-text-editor\" data-id=\"28258c2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">As we dive into the report , we see what type of ports are exposed to the internet. The majority of mail ports, which are expected to be lifted. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ebe82b8 elementor-widget elementor-widget-image\" data-id=\"ebe82b8\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Screenshot-2024-01-18-at-19.58.54.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"shoran.io exchange ports\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTY0MjgsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjRcLzAxXC9TY3JlZW5zaG90LTIwMjQtMDEtMTgtYXQtMTkuNTguNTQucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Screenshot-2024-01-18-at-19.58.54-qiic3dkvmkh3hf1v49bhq33hb8lwgkp7e692o7sc10.png\" title=\"shoran.io exchange ports\" alt=\"shoran.io exchange ports\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\">Exchange Report: Shodan.io<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-afccd04 elementor-widget elementor-widget-text-editor\" data-id=\"afccd04\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Another common method of discovery is Google Dorks. By using such queries, we discover OWA access cached by Google. Using the below &#8220;dork&#8221; we find exposed OWA services.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-94fa962 elementor-widget elementor-widget-code-highlight\" data-id=\"94fa962\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>intitle:\"Microsoft Outlook Web Access Log On\" | inurl:\/owa\/auth\/logon.aspx<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-afbeac3 elementor-widget elementor-widget-image\" data-id=\"afbeac3\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Google_Dork.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"google dork exchangeOWA\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTY0MjksInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjRcLzAxXC9Hb29nbGVfRG9yay5wbmcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Google_Dork-qiic2zhas1xsn9mcel836onkegje9458c8gsh2d8sq.png\" title=\"google dork exchangeOWA\" alt=\"google dork exchangeOWA\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-27fd2c2 elementor-widget elementor-widget-text-editor\" data-id=\"27fd2c2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Combine these techniques, with targeted <a href=\"https:\/\/infrasos.com\/install-and-configure-dns-server-on-windows-server\/\">DNS queries.<\/a> Also scan your IP space for common mail ports such as SMTP, POP3 and IMAP. This draws them to explore further. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1252401 elementor-widget elementor-widget-template\" data-id=\"1252401\" data-element_type=\"widget\" data-widget_type=\"template.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-template\">\n\t\t\t\t\t<div data-elementor-type=\"section\" data-elementor-id=\"7917\" class=\"elementor elementor-7917\">\n\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-30c8dcce ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default elementor-invisible\" data-id=\"30c8dcce\" data-element_type=\"section\" data-settings=\"{&quot;animation&quot;:&quot;bounceInRight&quot;,&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-19a106e2 ot-flex-column-vertical\" data-id=\"19a106e2\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ca1a12e elementor-widget elementor-widget-heading\" data-id=\"ca1a12e\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Try our Active Directory & Office 365 Reporting & Auditing Tools<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4c539a35 elementor-widget elementor-widget-text-editor\" data-id=\"4c539a35\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #ff6600;\">Try us out<\/span> for <span style=\"color: #ff0000;\">Free<\/span>.\u00a0 100&#8217;s of report templates available. Easily customise your own reports on AD, Azure AD &amp; Office 355.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-16296eed ot-flex-column-vertical\" data-id=\"16296eed\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-65568df5 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"65568df5\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor-pro - v3.10.3 - 29-01-2023 *\/\n.elementor-button.elementor-hidden,.elementor-hidden{display:none}.e-form__step{width:100%}.e-form__step:not(.elementor-hidden){display:flex;flex-wrap:wrap}.e-form__buttons{flex-wrap:wrap}.e-form__buttons,.e-form__buttons__wrapper{display:flex}.e-form__indicators{display:flex;justify-content:space-between;align-items:center;flex-wrap:nowrap;font-size:13px;margin-bottom:var(--e-form-steps-indicators-spacing)}.e-form__indicators__indicator{display:flex;flex-direction:column;align-items:center;justify-content:center;flex-basis:0;padding:0 var(--e-form-steps-divider-gap)}.e-form__indicators__indicator__progress{width:100%;position:relative;background-color:var(--e-form-steps-indicator-progress-background-color);border-radius:var(--e-form-steps-indicator-progress-border-radius);overflow:hidden}.e-form__indicators__indicator__progress__meter{width:var(--e-form-steps-indicator-progress-meter-width,0);height:var(--e-form-steps-indicator-progress-height);line-height:var(--e-form-steps-indicator-progress-height);padding-right:15px;border-radius:var(--e-form-steps-indicator-progress-border-radius);background-color:var(--e-form-steps-indicator-progress-color);color:var(--e-form-steps-indicator-progress-meter-color);text-align:right;transition:width .1s linear}.e-form__indicators__indicator:first-child{padding-left:0}.e-form__indicators__indicator:last-child{padding-right:0}.e-form__indicators__indicator--state-inactive{color:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-inactive [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-inactive-secondary-color,#fff)}.e-form__indicators__indicator--state-inactive object,.e-form__indicators__indicator--state-inactive svg{fill:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-active{color:var(--e-form-steps-indicator-active-primary-color,#39b54a);border-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active object,.e-form__indicators__indicator--state-active svg{fill:var(--e-form-steps-indicator-active-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed{color:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator--state-completed [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator__label{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator--shape-none{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a);background-color:initial}.e-form__indicators__indicator--state-completed object,.e-form__indicators__indicator--state-completed svg{fill:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator__icon{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);font-size:var(--e-form-steps-indicator-icon-size);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;overflow:hidden;margin-bottom:10px}.e-form__indicators__indicator__icon img,.e-form__indicators__indicator__icon object,.e-form__indicators__indicator__icon svg{width:var(--e-form-steps-indicator-icon-size);height:auto}.e-form__indicators__indicator__icon .e-font-icon-svg{height:1em}.e-form__indicators__indicator__number{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;margin-bottom:10px}.e-form__indicators__indicator--shape-circle{border-radius:50%}.e-form__indicators__indicator--shape-square{border-radius:0}.e-form__indicators__indicator--shape-rounded{border-radius:5px}.e-form__indicators__indicator--shape-none{border:0}.e-form__indicators__indicator__label{text-align:center}.e-form__indicators__indicator__separator{width:100%;height:var(--e-form-steps-divider-width);background-color:#c2cbd2}.e-form__indicators--type-icon,.e-form__indicators--type-icon_text,.e-form__indicators--type-number,.e-form__indicators--type-number_text{align-items:flex-start}.e-form__indicators--type-icon .e-form__indicators__indicator__separator,.e-form__indicators--type-icon_text .e-form__indicators__indicator__separator,.e-form__indicators--type-number .e-form__indicators__indicator__separator,.e-form__indicators--type-number_text .e-form__indicators__indicator__separator{margin-top:calc(var(--e-form-steps-indicator-padding, 30px) \/ 2 - var(--e-form-steps-divider-width, 1px) \/ 2)}.elementor-field-type-hidden{display:none}.elementor-field-type-html{display:inline-block}.elementor-login .elementor-lost-password,.elementor-login .elementor-remember-me{font-size:.85em}.elementor-field-type-recaptcha_v3 .elementor-field-label{display:none}.elementor-field-type-recaptcha_v3 .grecaptcha-badge{z-index:1}.elementor-button .elementor-form-spinner{order:3}.elementor-form .elementor-button>span{display:flex;justify-content:center;align-items:center}.elementor-form .elementor-button .elementor-button-text{white-space:normal;flex-grow:0}.elementor-form .elementor-button svg{height:auto}.elementor-form .elementor-button .e-font-icon-svg{height:1em}.elementor-select-wrapper .select-caret-down-wrapper{position:absolute;top:50%;transform:translateY(-50%);inset-inline-end:10px;pointer-events:none;font-size:11px}.elementor-select-wrapper .select-caret-down-wrapper svg{display:unset;width:1em;aspect-ratio:unset;fill:currentColor}.elementor-select-wrapper .select-caret-down-wrapper i{font-size:19px;line-height:2}.elementor-select-wrapper.remove-before:before{content:\"\"!important}<\/style>\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"7917\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"65568df5\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b1304ed elementor-widget elementor-widget-text-editor\" data-id=\"b1304ed\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/office-365-exchange-online-set-up-and-manage-exchange-online\/\">Office 365 Exchange Online: Set Up and Manage Exchange Online<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f59fc74 elementor-widget elementor-widget-heading\" data-id=\"f59fc74\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How They Are Attacking Exchange Server<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-67fbfd7 elementor-widget elementor-widget-text-editor\" data-id=\"67fbfd7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Finding Exchange servers is the easy part, however \u201chow are they exploiting them\u201d?\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Microsoft does a great job of documenting how attackers are exploiting Exchange vulnerabilities, and how they can chain their attacks.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aba8397 elementor-widget elementor-widget-image\" data-id=\"aba8397\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Exchange-servers-attack-chain-2.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Recent Cyber Threats Targeting Microsoft Exchange Server attack chain\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTY0MzAsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjRcLzAxXC9FeGNoYW5nZS1zZXJ2ZXJzLWF0dGFjay1jaGFpbi0yLnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"320\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Exchange-servers-attack-chain-2-768x320.png\" class=\"attachment-medium_large size-medium_large wp-image-56430\" alt=\"Recent Cyber Threats Targeting Microsoft Exchange Server attack chain\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Exchange-servers-attack-chain-2-768x320.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Exchange-servers-attack-chain-2-300x125.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Exchange-servers-attack-chain-2-1024x427.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Exchange-servers-attack-chain-2-720x300.png 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Exchange-servers-attack-chain-2.png 1200w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\">Microsoft Exchange Chain Attack<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-167d34f elementor-widget elementor-widget-heading\" data-id=\"167d34f\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Chaining Attacks<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4ceb935 elementor-widget elementor-widget-text-editor\" data-id=\"4ceb935\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">As seen in the diagram above, the <a href=\"https:\/\/infrasos.com\/exchange-server-2019-monitoring-best-practices\/\">Exchange exploit<\/a> is the initial access stage. The attacker then goes on to chain the attack, moving through the network. This is why it&#8217;s important to have the &#8220;assumed breach&#8221; mindset. Although protecting Exchange is critical, remembering that it\u2019s externally facing, should bring concern for the estate. Your Exchange server may get compromised, however this would be an isolated attack. Should the attack get a shell, with a <a href=\"https:\/\/infrasos.com\/azure-ad-privileged-identity-management-manage-monitor-privileged-accounts\/\">privileged account<\/a>, lateral movement may be on the table.<\/span><\/p><p><span style=\"font-weight: 400;\">Companies need to limit the blast radius for these types of attacks. Simple methods of reducing the blast radius, are:\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\"><strong>Don\u2019t store, or use shared privileged service accounts<\/strong> on your external facing servers.<br \/><\/span><\/li><li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\"><strong>Don&#8217;t rely on permitter firewalls. <\/strong>Implement east &lt;&gt; west controls using network security groups, or<a href=\"https:\/\/infrasos.com\/configure-and-manage-windows-firewall-for-your-windows-server\/\"> Windows firewall<\/a>.\u00a0<\/span><\/li><li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\"><strong>Isolate Exchange servers<\/strong>. Isolating your Exchange servers reduces human error.\u00a0<\/span><\/li><li><strong>Break the shell<\/strong>. Disabling Powershell v5, or limiting shell (<a href=\"https:\/\/infrasos.com\/managing-azure-ad-applications-with-powershell\/\">cmd, Powershell<\/a>) usage reduces what an attacker can do, post exploit.\u00a0<\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4985e3b elementor-widget elementor-widget-text-editor\" data-id=\"4985e3b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/office-365-reporting\/\">Get information about your users by using Office 365 Reporting Tool<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9ac7b1c elementor-widget elementor-widget-heading\" data-id=\"9ac7b1c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Bad Patch Management <\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1b25f54 elementor-widget elementor-widget-text-editor\" data-id=\"1b25f54\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Just because a patch is made available, it\u2019s not always installed. A perfect example is ProxyLogon &#8211; <\/span><a href=\"https:\/\/proxylogon.com\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">https:\/\/proxylogon.com\/<\/span><\/a><span style=\"font-weight: 400;\">\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">ProxyLogon has had a patch for some time, however as you can see in the graph below, the risk remains. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4cc932d elementor-widget elementor-widget-image\" data-id=\"4cc932d\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2024\/01\/Screenshot-2024-01-18-at-20.22.39.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Recent Cyber Threats Targeting Microsoft Exchange Server   shodan proxy logon report\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTY0MzEsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjRcLzAxXC9TY3JlZW5zaG90LTIwMjQtMDEtMTgtYXQtMjAuMjIuMzkucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Screenshot-2024-01-18-at-20.22.39-qiic5c2rv55lo67golsif3b1v4yfhvh2nv6hnyvtbs.png\" title=\"Recent Cyber Threats Targeting Microsoft Exchange Server   shodan proxy logon report\" alt=\"Recent Cyber Threats Targeting Microsoft Exchange Server shodan proxy logon report\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f95954f elementor-widget elementor-widget-text-editor\" data-id=\"f95954f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Examples such as this illustrate how unpatched services are exploited. Whilst many see new headlines, and fear some sophisticated attacks have occurred, in many cases, the initial access was obtained via an <a href=\"https:\/\/infrasos.com\/azure-security-center-best-practices-how-to-secure-azure\/\">unpatched server<\/a>.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">In this case, attackers exploited ProxyLogon, and chained the attacks. This gave them unauthenticated access, and remote code execution as admin. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5b845ca elementor-widget elementor-widget-heading\" data-id=\"5b845ca\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Threat Actors Attacking Exchange<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c4d5ec2 elementor-widget elementor-widget-text-editor\" data-id=\"c4d5ec2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">\u00a0Although the Exchange server may be the target, their \u201cpost-exploit\u201d steps may cause the real damage.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Below, I share some examples and links to show recent threat actors, and articles covering patterns and methods of attack.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-045c8f3 elementor-widget elementor-widget-text-editor\" data-id=\"045c8f3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><span style=\"font-weight: 400;\"><strong>CVE-2023-23397 Exploitation by Forest Blizzard (STRONTIUM):<\/strong> Microsoft identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM), based in Russia, actively exploiting\u00a0<\/span><span style=\"font-weight: 400;\">CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers. Forest Blizzard commonly seeks and employs publicly available exploits in addition to CVE-2023-23397.<\/span><\/li><\/ul><p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/24\/guidance-for-investigating-attacks-using-cve-2023-23397\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Guidance for investigating attacks using CVE-2023-23397 | Microsoft Security Blog<\/span><\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0e86aaf elementor-widget elementor-widget-text-editor\" data-id=\"0e86aaf\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><span style=\"font-weight: 400;\"><strong>Storm-0558 Unauthorized Email Access:<\/strong> On June 16, 2023, Microsoft was notified by a customer of anomalous Exchange Online data access. Microsoft analysis attributed the activity to Storm-0558 based on established prior TTPs. Storm-0558 was accessing the customer\u2019s Exchange Online data using Outlook Web Access (OWA).<\/span><\/li><\/ul><p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/07\/14\/analysis-of-storm-0558-techniques-for-unauthorized-email-access\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Analysis of Storm-0558 techniques for unauthorized email access | Microsoft Security Blog<\/span><\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8af9e80 elementor-widget elementor-widget-text-editor\" data-id=\"8af9e80\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/office-365-threat-intelligence-detecting-and-responding\/\">Office 365 Threat Intelligence: Detecting and Responding<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-32552a6 elementor-widget elementor-widget-heading\" data-id=\"32552a6\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Securing Your Exchange Servers<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fc3da95 elementor-widget elementor-widget-text-editor\" data-id=\"fc3da95\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Follow best practises of securing your Exchange servers.\u00a0<\/p><ol><li style=\"font-weight: 400;\"><b>Apply Patches Frequently<\/b><span style=\"font-weight: 400;\"> &#8211; This really help\u00a0 to reduce the <a href=\"https:\/\/infrasos.com\/protecting-against-phishing-attacks-in-office-365\/\">attack surface<\/a> or your Exchange server. Make sure to apply both operating system, and Exchange patches when released.<\/span><\/li><li style=\"font-weight: 400;\"><b>Remove Unnecessary Services <\/b><span style=\"font-weight: 400;\">&#8211; ECP (Admin) portal is a perfect example of this. You don\u2019t need your admin portal over the internet, so remove this access, or limit inbound connections. This includes blocking ports that are not in use.\u00a0<\/span><\/li><li style=\"font-weight: 400;\"><b>Remove Exposure <\/b><span style=\"font-weight: 400;\">&#8211; Run your Exchange server within your network, requiring you users to connect to VPN first. Although this reduces flexibility, it does remove the majority of risk.\u00a0<\/span><\/li><li style=\"font-weight: 400;\"><b>Use Available Resources<\/b><span style=\"font-weight: 400;\"> &#8211; Microsoft offers quite a lot of \u201csafety\u201d scripts and tools to <a href=\"https:\/\/infrasos.com\/office-365-threat-intelligence-detecting-and-responding\/\">scan for threats<\/a>. It\u2019s worth looking at these, and see if they can benefit you.<\/span><\/li><li style=\"font-weight: 400;\"><b>Protect The Host<\/b><span style=\"font-weight: 400;\"> &#8211; Protecting the host is key. Although Exchange is the service, it\u2019s running on a host. If an exploit is passed, your EDR may be able to detect the threat from the OS logs.\u00a0<\/span><\/li><li style=\"font-weight: 400;\"><b>Scan The Traffic <\/b><span style=\"font-weight: 400;\">&#8211; Inbound traffic often passes through a <a href=\"https:\/\/infrasos.com\/secure-azure-network-with-azure-firewall-security-groups\/\">Firewall<\/a> or Load Balancer. If this is the case, scan the traffic. This helps to block, if your firewall provider has a signature (IPS\/IDS), whilst also giving you visibility.\u00a0<\/span><\/li><li><b>Enable Logging and Monitor<\/b><span style=\"font-weight: 400;\"> &#8211; It\u2019s important to enable logging, and review how much visibility you have. Whilst protecting the server\/service is key, being able to identify what happened or what is happening will bring greater value. If a Zero day does hit, at least you have the logs. This gives you some fighting chance.<\/span><\/li><li><strong>Reduce lateral movement<\/strong> &#8211; \u00a0Controlling and limiting traffic to and from your Exchange servers, ensures, that attackers cannot spread further into the network.\u00a0<\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6fbf789 elementor-widget elementor-widget-text-editor\" data-id=\"6fbf789\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Well, this is it. Thank you for your time. I hope you know far more about Recent Cyber Threats Targeting Microsoft Exchange Server. Shall we conclude?<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0fd5084 elementor-widget elementor-widget-text-editor\" data-id=\"0fd5084\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-ad-identity-protection-detect-respond-to-identity-threats\/\">Azure AD Identity Protection: Detect &amp; Respond to Identity Threats<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3af881f elementor-widget elementor-widget-heading\" data-id=\"3af881f\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Recent Cyber Threats Targeting Microsoft Exchange Server Summary<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-da10b61 elementor-widget elementor-widget-text-editor\" data-id=\"da10b61\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">All in all, Microsoft offer some in-depth advice on how to secure Exchange Servers. If you are still hosting Exchange and concerned about what the future holds, it&#8217;s defiantly worth the read: \u00a0<\/span><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/06\/24\/defending-exchange-servers-under-attack\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/06\/24\/defending-exchange-servers-under-attack\/<\/span><\/a><\/p><p>After you&#8217;ve read the advice, review your incident response plan. Exchange servers continue to be a target. An important question you can ask yourself is, &#8220;Could you spot an attack, if they got in&#8221;?\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-54ea2c33 elementor-section-content-middle ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"54ea2c33\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-extended\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-6b263a5e ot-flex-column-vertical\" data-id=\"6b263a5e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6efda21 elementor-widget elementor-widget-image\" data-id=\"6efda21\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"113\" height=\"101\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/05\/InfraSOS-Logo-Icon-1.png\" class=\"attachment-full size-full wp-image-5788\" alt=\"InfraSOS-AD-Tools\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-29ffc151 ot-flex-column-vertical\" data-id=\"29ffc151\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-69cd5e2a elementor-widget elementor-widget-heading\" data-id=\"69cd5e2a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Try InfraSOS for FREE<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-20bb3ce elementor-widget elementor-widget-text-editor\" data-id=\"20bb3ce\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Try InfraSOS Active Directory, Azure AD &amp; Office 365 Reporting &amp; Auditing Tool<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-655b160c elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"655b160c\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"56425\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"655b160c\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73640d57 elementor-icon-list--layout-inline elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"73640d57\" data-element_type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/infrasos.com\/wp-content\/plugins\/elementor\/assets\/css\/widget-icon-list.min.css\">\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-up\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Free 15-Days Trial<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">SaaS AD Reporting & Auditing Solution<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Recent Cyber Threats Targeting Microsoft Exchange Server. Microsoft Exchange servers remain a prime focus for threat actors, as evidenced by the sustained targeting they endure. Despite the migration of some businesses to cloud services like O365, Exchange on-premise continues to have a large presence amongst publicly exposed services. Unlike standard web applications, Exchange requires a [&hellip;]<\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39],"tags":[140,138,130],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Recent Cyber Threats Targeting Microsoft Exchange Server<\/title>\n<meta name=\"description\" content=\"Recent Cyber Threats Targeting Microsoft Exchange Server. Microsoft Exchange servers remain a prime focus for threat actors, as evidenced by the sustained\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recent Cyber Threats Targeting Microsoft Exchange Server\" \/>\n<meta property=\"og:description\" content=\"Recent Cyber Threats Targeting Microsoft Exchange Server. Microsoft Exchange servers remain a prime focus for threat actors, as evidenced by the sustained\" \/>\n<meta property=\"og:url\" content=\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/\" \/>\n<meta property=\"og:site_name\" content=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infrasos\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-01-29T09:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-24T17:14:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Screenshot-2024-01-18-at-19.57.57-qiic49je2xoug5rfxn4t2v15ic8dqa82ukfkzmgyco.png\" \/>\n<meta name=\"author\" content=\"Ashley Moran\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:site\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ashley Moran\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/\"},\"author\":{\"name\":\"Ashley Moran\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/496a59a94491b5f6d8e36fd9dd0f7168\"},\"headline\":\"Recent Cyber Threats Targeting Microsoft Exchange Server\",\"datePublished\":\"2024-01-29T09:30:00+00:00\",\"dateModified\":\"2024-01-24T17:14:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/\"},\"wordCount\":1206,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"keywords\":[\"cyber threats\",\"Exchange Server\",\"threat intelligence\"],\"articleSection\":[\"Microsoft Exchange\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/\",\"url\":\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/\",\"name\":\"Recent Cyber Threats Targeting Microsoft Exchange Server\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/#website\"},\"datePublished\":\"2024-01-29T09:30:00+00:00\",\"dateModified\":\"2024-01-24T17:14:07+00:00\",\"description\":\"Recent Cyber Threats Targeting Microsoft Exchange Server. Microsoft Exchange servers remain a prime focus for threat actors, as evidenced by the sustained\",\"breadcrumb\":{\"@id\":\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/infrasos.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Recent Cyber Threats Targeting Microsoft Exchange Server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/infrasos.com\/#website\",\"url\":\"https:\/\/infrasos.com\/\",\"name\":\"Active Directory Tools, Report, Monitor &amp; Manage AD\",\"description\":\"Active Directory &amp; Office 365 SaaS Reporting Tool\",\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/infrasos.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/infrasos.com\/#organization\",\"name\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\",\"url\":\"https:\/\/infrasos.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"contentUrl\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"width\":113,\"height\":101,\"caption\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\"},\"image\":{\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/infrasos\/\",\"https:\/\/twitter.com\/infra_sos\",\"https:\/\/www.linkedin.com\/showcase\/86283876\",\"https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/496a59a94491b5f6d8e36fd9dd0f7168\",\"name\":\"Ashley Moran\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/53facb5950e030622059390a681cf824?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/53facb5950e030622059390a681cf824?s=96&d=mm&r=g\",\"caption\":\"Ashley Moran\"},\"description\":\"I am a seasoned Security Engineer with several years of experience, primarily in the healthcare industry.\",\"sameAs\":[\"https:\/\/amoran.io\",\"https:\/\/www.linkedin.com\/in\/ashleymoran\/\"],\"url\":\"https:\/\/infrasos.com\/author\/amoranioshgmail-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Recent Cyber Threats Targeting Microsoft Exchange Server","description":"Recent Cyber Threats Targeting Microsoft Exchange Server. Microsoft Exchange servers remain a prime focus for threat actors, as evidenced by the sustained","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/","og_locale":"en_US","og_type":"article","og_title":"Recent Cyber Threats Targeting Microsoft Exchange Server","og_description":"Recent Cyber Threats Targeting Microsoft Exchange Server. Microsoft Exchange servers remain a prime focus for threat actors, as evidenced by the sustained","og_url":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/","og_site_name":"Active Directory Tools, Report, Monitor &amp; Manage AD","article_publisher":"https:\/\/www.facebook.com\/infrasos\/","article_published_time":"2024-01-29T09:30:00+00:00","article_modified_time":"2024-01-24T17:14:07+00:00","og_image":[{"url":"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Screenshot-2024-01-18-at-19.57.57-qiic49je2xoug5rfxn4t2v15ic8dqa82ukfkzmgyco.png"}],"author":"Ashley Moran","twitter_card":"summary_large_image","twitter_creator":"@infra_sos","twitter_site":"@infra_sos","twitter_misc":{"Written by":"Ashley Moran","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/#article","isPartOf":{"@id":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/"},"author":{"name":"Ashley Moran","@id":"https:\/\/infrasos.com\/#\/schema\/person\/496a59a94491b5f6d8e36fd9dd0f7168"},"headline":"Recent Cyber Threats Targeting Microsoft Exchange Server","datePublished":"2024-01-29T09:30:00+00:00","dateModified":"2024-01-24T17:14:07+00:00","mainEntityOfPage":{"@id":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/"},"wordCount":1206,"commentCount":0,"publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"keywords":["cyber threats","Exchange Server","threat intelligence"],"articleSection":["Microsoft Exchange"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/","url":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/","name":"Recent Cyber Threats Targeting Microsoft Exchange Server","isPartOf":{"@id":"https:\/\/infrasos.com\/#website"},"datePublished":"2024-01-29T09:30:00+00:00","dateModified":"2024-01-24T17:14:07+00:00","description":"Recent Cyber Threats Targeting Microsoft Exchange Server. Microsoft Exchange servers remain a prime focus for threat actors, as evidenced by the sustained","breadcrumb":{"@id":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/infrasos.com\/recent-cyber-threats-targeting-microsoft-exchange-server\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/infrasos.com\/"},{"@type":"ListItem","position":2,"name":"Recent Cyber Threats Targeting Microsoft Exchange Server"}]},{"@type":"WebSite","@id":"https:\/\/infrasos.com\/#website","url":"https:\/\/infrasos.com\/","name":"Active Directory Tools, Report, Monitor &amp; Manage AD","description":"Active Directory &amp; Office 365 SaaS Reporting Tool","publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/infrasos.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/infrasos.com\/#organization","name":"InfraSOS - Active Directory & Office 365 Reporting Tools","url":"https:\/\/infrasos.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/","url":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","contentUrl":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","width":113,"height":101,"caption":"InfraSOS - Active Directory & Office 365 Reporting Tools"},"image":{"@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infrasos\/","https:\/\/twitter.com\/infra_sos","https:\/\/www.linkedin.com\/showcase\/86283876","https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg"]},{"@type":"Person","@id":"https:\/\/infrasos.com\/#\/schema\/person\/496a59a94491b5f6d8e36fd9dd0f7168","name":"Ashley Moran","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/53facb5950e030622059390a681cf824?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/53facb5950e030622059390a681cf824?s=96&d=mm&r=g","caption":"Ashley Moran"},"description":"I am a seasoned Security Engineer with several years of experience, primarily in the healthcare industry.","sameAs":["https:\/\/amoran.io","https:\/\/www.linkedin.com\/in\/ashleymoran\/"],"url":"https:\/\/infrasos.com\/author\/amoranioshgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/56425"}],"collection":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/comments?post=56425"}],"version-history":[{"count":49,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/56425\/revisions"}],"predecessor-version":[{"id":56612,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/56425\/revisions\/56612"}],"wp:attachment":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/media?parent=56425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/categories?post=56425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/tags?post=56425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}