Microsoft Exchange under attack as LockFile ransomware targets servers

Security researchers claim to have discovered a new ransomware family called LockFile that seems to the same that was used earlier to attack Microsoft Exchange servers in the US and Asia. According to Symantec, previously unseen ransomware has hit at least 10 companies in the ongoing campaign. These targets are across industries.

The LockFile ransomware was first observed on the network of a US financial organisation on July 20, 2021, with its latest activity seen as recently as August 20.

How the new attack works

As per Symantec, there are signs that the attackers gain access to victims’ networks via Microsoft Exchange Servers, and then use the incompletely patched PetitPotam vulnerability to gain access to the domain controller, and then spread across the network.