Organizations using Microsoft Exchange now have a new security headache: never-before-seen ransomware that’s being installed on servers that were already infected by state-sponsored hackers in China.

Microsoft reported the new family of ransomware deployment late Thursday, saying that it was being deployed after the initial compromise of servers. Microsoft’s name for the new family is Ransom:Win32/DoejoCrypt.A. The more common name is DearCry.

Piggybacking off Hafnium

Security firm Kryptos Logic said Friday afternoon that it has detected Hafnium-compromised Exchange servers that were later infected with ransomware. Kryptos Logic security researcher Marcus Hutchins told Ars that the ransomware is DearCry.

“We’ve just discovered 6970 exposed webshells which are publicly exposed and were placed by actors exploiting the Exchange vulnerability,” Kryptos Logic said. “These shells are being used to deploy ransomware.” Webshells are backdoors that allow attackers to use a browser-based interface to run commands and execute malicious code on infected servers.

Anyone who knows the URL to one of these public webshells can gain complete control over the compromised server. The DearCry hackers are using these shells to deploy their ransomware. The webshells were initially installed by Hafnium, the name Microsoft has given to a state-sponsored threat actor operating out of China.

Hutchins said that the attacks are “human operated,” meaning a hacker manually installs ransomware on one Exchange server at a time. Not all of the nearly 7,000 servers have been hit by DearCry.

“Basically, we’re starting to see criminal actors using shells left behind by Hafnium to get a foothold into networks,” Hutchins explained.

The deployment of ransomware, which security experts have said was inevitable, underscores a key aspect about the ongoing response to secure servers exploited by ProxyLogon. It’s not enough to simply install the patches. Without removing the webshells left behind, servers remain open to intrusion, either by the hackers who originally installed the backdoors or by other fellow hackers who figure out how to gain access to them.

Little is known about DearCry. Security firm Sophos said that it’s based on a public-key cryptosystem, with the public key embedded in the file that installs the ransomware. That allows files to be encrypted without the need to first connect to a command-and-control server. To decrypt the data, victims’ must obtain the private key that’s known only to the attackers.

Among the first to discover DearCry was Mark Gillespie, a security expert who runs a service that helps researchers identify malware strains. On Thursday, he reported that, beginning on Tuesday, he started receiving queries from Exchange servers in the US, Canada, and Australia for malware that had the string “DEARCRY.”

He later found someone posting to a user forum on Bleeping Computer saying the ransomware was being installed on servers that had first been exploited by Hafnium. Bleeping Computer soon confirmed the hunch.

John Hultquist, a vice president at security firm Mandiant, said piggybacking on the hackers who installed the webshells can be a faster and more efficient means to deploy malware on unpatched servers than exploiting the ProxyLogon vulnerabilities. And as already mentioned, even if servers are patched, ransomware operators can still compromise the machines when webshells haven’t been removed.

“We are anticipating more exploitation of the exchange vulnerabilities by ransomware actors in the near term,” Hultquist wrote in an email. “Though many of the still unpatched organizations may have been exploited by cyber espionage actors, criminal ransomware operations may pose a greater risk as they disrupt organizations and even extort victims by releasing stolen emails.”

Update 7:40 pm EST: This post was updated to remove “7,000” from the headline and to make clear not all of them have been infected with ransomware.

https://arstechnica.com/?p=1749428