HAFNIUM targeting Exchange Servers with 0-day exploits

[Dayananda]

Hello,

Mcafee has released an article to keep customers informed about the coverage. Please refer to the below link and subscribe to it so that if there are any updates you will be informed.

McAfee coverage for Exchange Servers targeted with zero-day exploits by the HAFNIUM Threat Group
Technical Articles ID: KB94270
https://kc.mcafee.com/corporate/index?page=content&id=KB94270

I hope this helps, let us know if you have any queries.

[galih27]

okay i am waiting for the information that ens can cover HAFNIUM

[th3stinger]

Thank you for the reply.

While waiting, can we get any data from the Active Response module  queries based on the attachment below? 

We have deployed the active response in order to do some forensic work. 

MS has deployed hunting queries (see attached) 

[galih27]

several antivirus vendors have issued their statements such as the results of analysis related to hafnium
I still don't get the right answer from mcafee regarding their product endpoint

[Nielsb]

Update in KB94270

March 5, 2021Added Extra.DAT attachment.

McAfee Insights:
Campaign can be found by searching for: Exchange Servers targeted with zero-day exploits by the HAFNIUM Threat Group

[galih27]

is there any more updates from mcafee regarding this

[web1b]

Is the extra.dat file still needed?

At what point will this be covered through the normal DAT update process?

Is this covered in both VSE and ENS for Windows servers?

[AdithyanT]

HI @web1b ,

The ED contains coverage for a specific IOC that is now covered via regular DAT. ED is no more necessary unless we have further developments that we shall duly update to all of our Customers via the KB.