Unexpected Spam email in Outlook Draft folder

JOE TAM 101

Dear sir,

A user found that he has 2 unexpected email in his draft folder today, the message is not belonged to him. Server is Exchange 2019, Outlook is also version 2019.

The email subject name is created by random character: atsgtzpuisiumus , another same email subject is : asdfareafaas.

Inside the email content, both are the same single sentence: "hello darkness my old friend".

It seems that it is an unexpected spam message.  May I know how to check why the message can exist inside user of "Draft" folder?

Any suggestion to trace or prevent such message? Or PC has been hacked by virus?

Regards,
Joe Tam

Sean Rosen 1 Reputation point

2021-09-10T02:15:03.973+00:00

Just had this happen to me and it started 9/7/21

the hackers were attempting to use the random drafts and export them.

on inhouse exchange founds files in wwwroot/netframework64 and used windows defender to remove them
found it was coming from Netherlands: 95.179.145.105
KyleXu-MSFT 26,261 Reputation points

2021-09-13T08:00:42.177+00:00

@JOE TAM

Any update about this thread now? Whether this phenomenon gone?
If the suggestion below helps, please be free to accept it as an answer for helping more people.
David Rucker 6 Reputation points

2021-09-18T13:07:44.54+00:00

Hello.
We just recovered and investigated a ransomware attack where this was found after recovery was completed.
Your exchange server has been compromised.
These outbound messages are being used to advertise your server to the darkweb as "available for hacking" and will be sold. The buyer may purchase a ransomware as a service then use the hook to easily deploy ransomware with little effort.

You need to run the microsoft safety scanner (called MSERT) to help remove the hook they have in place and immediately install the latest exchange CU and security patches. Its not a matter of if but when your server will be attacked otherwise.

Good luck with this!

6 answers

KyleXu-MSFT 26,261 Reputation points

2021-09-10T06:33:37.24+00:00
@JOE TAM

Here is a blog from Microsoft, it said: ProxyShell vulnerabilities and your Exchange Server

Your Exchange servers are vulnerable if any of the following are true:

The server is running an older, unsupported CU (without May 2021 SU);

The server is running security updates for older, unsupported versions of Exchange that were released in March 2021; or

The server is running an older, unsupported CU, with the March 2021 EOMT mitigations applied.

In all of the above scenarios, you must install one of latest supported CUs and all applicable SUs to be protected. Any Exchange servers that are not on a supported CU and the latest available SU are vulnerable to ProxyShell and other attacks that leverage older vulnerabilities.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
Samijuke 6 Reputation points

2021-09-10T08:26:04.57+00:00

indeed it is the proxyshell vulnerability, we have updated Exchange on our side

Cesar 41 Reputation points

2021-09-15T18:51:34.803+00:00

Hi,
We are experiencing the same issue. Which CU did you upgrade from?

We are currently running CU4.

Thank you

Samijuke 6 Reputation points

2021-10-01T11:48:23.313+00:00

Exchange 2019 CU 10 ;)
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Andy David - MVP 148.1K Reputation points MVP

2021-09-09T11:27:45.083+00:00

I suspect your server has been hacked:
https://www.fireeye.com/blog/threat-research/2021/09/proxyshell-exploiting-microsoft-exchange-servers.html

Have you applied the latest July critical security updates for Exchange?
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Samijuke 6 Reputation points

2021-09-09T11:43:40.897+00:00

Hello,

I have the same drafts from a user, with the same subject "hello darkness my old friend".

Bitdefender antivirus shows nothing, the PC and office suite 2019 are up to date, as well as Exchange 2019.

If you have more info I'm interested.

Best regards

Sami
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Andy David - MVP 148.1K Reputation points MVP

2021-09-09T11:47:36.173+00:00

Also See:
https://www.reddit.com/r/sysadmin/comments/pf2fxv/mysterious_hi_in_outlook_draft_folder/
Please sign in to rate this answer.
Samijuke 6 Reputation points

2021-09-09T12:20:44.113+00:00

Thanks !
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Max Fury 156 Reputation points

2021-10-01T04:46:15.627+00:00

I too have faced such a problem. If I can get any help from here then I will be grateful.
Please sign in to rate this answer.
Samijuke 6 Reputation points

2021-10-01T11:47:37.103+00:00

Hi !

update your exchange server and you will be protected

HoneyM 0 Reputation points

2024-01-09T23:37:23.88+00:00

Hi, I have the same problem and I had Windows Defender which blocked everything.

What action did you take to resolve it?

I ran Microsoft SERT and updated the server that originally had cu18 to the latest cu23.

HoneyM 0 Reputation points

2024-01-09T23:40:00.8733333+00:00

Hi, I have the same problem and I had Windows Defender which blocked everything.

What action did you take to resolve it?

I ran Microsoft SERT and updated the server that originally had cu18 to the latest cu23.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Unexpected Spam email in Outlook Draft folder

6 answers

Your answer