{"id":3395,"date":"2025-04-19T10:05:21","date_gmt":"2025-04-19T10:05:21","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/04\/19\/hackers-actively-exploiting-critical-exchange-sharepoint-server-vulnerabilities\/"},"modified":"2025-04-19T10:05:21","modified_gmt":"2025-04-19T10:05:21","slug":"hackers-actively-exploiting-critical-exchange-sharepoint-server-vulnerabilities","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/04\/19\/hackers-actively-exploiting-critical-exchange-sharepoint-server-vulnerabilities\/","title":{"rendered":"Hackers Actively Exploiting Critical Exchange & SharePoint Server Vulnerabilities"},"content":{"rendered":"\n
Hackers Actively Exploiting Critical Exchange & SharePoint Server Vulnerabilities<\/div>\n

\t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Microsoft has warned organizations worldwide that threat actors are ramping up their exploitation of critical vulnerabilities in on-premises Exchange Server and SharePoint Server.<\/p>\n

These attacks, observed in recent months, have enabled cybercriminals to gain persistent and privileged access to targeted environments, leading to remote code execution, lateral movement, and the exfiltration of sensitive data.<\/p>\n

While Exchange and SharePoint servers have long been attractive targets due to the sensitive data they store, attackers are now deploying increasingly sophisticated techniques.<\/p>\n

\nNTLM Relay and Stealthy Persistence<\/strong> Techniques<\/strong>
\n<\/h2>\n

A notable shift has been the rise of NTLM relay and credential leakage attacks against Exchange Server<\/a>. In these scenarios, attackers exploit weaknesses in the NTLM authentication protocol by relaying stolen credentials to vulnerable servers, potentially compromising user accounts and enabling further malicious activity.<\/p>\n

\n
\n
\n

Threat actors have consistently exploited critical vulnerabilities in Exchange Server and SharePoint Server that enable them to gain a persistent foothold inside the target. Such attacks have been observed to lead to remote code execution, lateral movement, and exfiltration of\u2026<\/p>\n

\u2014 Microsoft Threat Intelligence (@MsftSecIntel) April 18, 2025<\/a>\n<\/p><\/blockquote>\n