Exchange Server Vulnerability - Still Having Issues after all Patch and CU20 Updates

Question

Hello everyone,

As per Microsoft Recommendations, we already installed all security patches earlier in the March and installed CU 20 updates. Here are the details about our issues. Any help on this will be appreciated:

Issue: High CPU utilization due to cmd.exe process

Exchange 2016 Standard

Work done so far:
All patches installed, CU 20 installed, Performed multiple scan with Microsoft Safety Scanner, every time it finds and remove "Backdoor:MSIL/Chopper.F!dha " but next day same issue occurs

Opened CMD.exe file with process explorer today and found following scripts:
C:\Windows\System32\cmd.exe -o 95.216.46.125:443 -u 44EspGiviPdeZSZyX1r3R9RhpGCkxYACEKUwbA4Gp6cVCzyiNeB21STWYsJZYZeZt63JaUn8CVxDeWWGs3f6XNxGPtSuUEX -k --tls -p MOON

Also ran Exchange Mitigation Tool and it did not found anything.

Answer 1

We have to remember that there was a gap of 55 days between the earliest detected exploits in January and Microsoft releasing any patches in March.

During this window, the miscreants deployed their webshells - many of which remain undetected by security software. These are now being used to launch data exfiltration and/or ransomware operations.

We're about to wipe and redeploy ourselves. Fully patched Windows Server and Exchange 2019.

I'm more curious to know why On-Premises Exchange was vulnerable but Online Exchange wasn't. A cynic might say it's to "encourage" migration to subscription services...

Answer 2

i have the same problem with Exchange 2013, found some backdoor and Trojan..

Answer 3

Same problem on 2 exchange 2016 servers for 2 customers. Seems to be only happening on 2016. Customers with 2019 and even one with an old 2013 install have no problems.

After killing the mining process and running MSERT it's always Chopper.F!dha that is found. But a few hours later it just comes back
Every form of patch/mitigation has been tried, as well as all possible versions of the nmap checks but they all say it's safe. But it just isn't.

The first customer was migrated to 2019 and the problem stopped as soon as internet access port 443 was changed from the 2016 server to the 2019, so pretty sure it's remotely triggered.

Saying it's not an exchange problem but a windows server problem is cute, but the only reason these servers have IIS installed is because of exchange and not running anything else on it. It seems that microsoft just didn't fix it enough on exchange 2016.
I guess they like to sell 2019 but upgrading is not always an option, upgrading the second customer will probably be a lot harder. A real fix would be nice.

Answer 4

Hi @JSS CGY ,

The same is happening to me. Did you find a solution?

Thanks

Answer 5

Hi @JSS CGY ,
Are there any Exchange functions that are not working properly?

According to my research on "Backdoor:MSIL/Chopper.F!dha ", I found that this is a security issue about Windows server, not specific to Exchange. I can provide limited help. So I help you add a "Windows-server-security" tag, which will bring in professional engineers to help you.

Based on my research on this issue, I recommend that you upgrade your Windows server to the latest version and install the relevant Security update. Then you could scan your PC by using Microsoft Defender. In addition, if all the methods cannot be solved, reinstalling the Windows system will be our last choice.
For more information you could refer to: Troubleshoot problems with detecting and removing malware

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.