Russian Military Attacks Exim Email Vulnerability

The NSA recently posted a security advisory about Sandworm Team, a group of Russian military technology threat actors who are giving Exim users a reason to be nervous. Exim, the widely used software mail transfer agent (MTA) has a vulnerability that Sandworm Team has been exploiting since at least August of last year. Although the company issued a patch for the flaw the same year, the NSA reminds Exim users to apply the patch immediately, as the attacks by Russia’s own technology GRU still continue.

The NSA believes there are still millions using unpatched Exim MTA’s. Named The Return of the WIZard, the Exim security flaw allows remote attackers to command the vulnerable mail servers. After sending a loaded email to recipients, unauthenticated bad actors can disable network security settings, add privileged users, and provide for further network exploits. As the NSA puts it “When the patch was released last year, Exim urged its users to update to the latest version. NSA adds its encouragement to immediately patch to mitigate against this still current threat.”

A search by BleepingComputer found there are approximately 2,481,000 servers still using vulnerable versions of Exim. For the 2,467,000 servers that were updated with the Exim 4.93 or newer patched release, Sandworm Team doesn’t currently pose a threat, so if you are using Exim, make sure you’re on the latest version.

The NSA would agree the more than 50% of Exim MTA users who have yet to apply the patch have a reason to be concerned. The organization doesn’t take security lightly, and when it features a warning on the Cybersecurity Advisory on their website, it’s time to take notice. It also provides Indicators of Compromise for this advisory, helping users detect unauthorized changes and exploit attempts. They advise “System administrators should continually check software versions and update as new versions become available.”