Forum Discussion

gigits's avatar
gigits
Copper Contributor
Sep 30, 2021

hello darkness my old friend worrying emails in draft

hi everyone,  we run on premise exchange 2019 and outlook clients keep showing a email message in Draft folder with content - "hello darkness my old friend" server is fully patch with latest cu but m...
exchange 2019
BerndW's avatar
BerndW
Copper Contributor
Oct 04, 2021

Hi there,

 

we are facing the same strange mails with Exchange 2016. We are just updating to CU22 and did not find any evidence of a virus/backdoor at all. MSERT shows nothing and I cannot find any strange webhooks, aspx files or other things.

 

Mails still keep coming.

 

Did you find any clue?

 

Best regards,

Bernd

James1's avatar
James1
Brass Contributor
Oct 05, 2021

BerndW For us we indeed notice some webhooks under the Program Files, applicationHost.config has been altered aswell - there been virtual directories added. We deleted those, fully patched the server, did multiple MSRT full scans. After that the mails in the draft still apeared. 

 

We fully deleted those mails from user boxes via 

Get-Mailbox | Search-Mailbox -SearchQuery 'attachment:FileAttachment.txt' -DeleteContent

 

You can check if you have those emails here

Get-Mailbox | Search-Mailbox -SearchQuery 'attachment:FileAttachment.txt' -EstimateResultOnly | Select-Object -Property Identity, ResultItemsCount

 

After deletion those emails are no longer appearing, however were still monitoring, also a fresh Exchange server is in the works.

 

  • BerndW's avatar
    BerndW
    Copper Contributor
    Oct 05, 2021
    Hi James,

    thanks for your info and the powershell commands. I'll let our customer run both. I'm still hoping that we don't have to reinstall the cluster.

    Best regards,
    Bernd
    • albsej's avatar
      albsej
      Copper Contributor
      Nov 28, 2021

      BerndWHi, did it work on you, where did you run the command, is it from the Exchange server or in the user computer? Thanks for the reply 🙂

      • BerndW's avatar
        BerndW
        Copper Contributor
        Nov 29, 2021

        albsej Hi, the command has to be run inside an exchange management shell. And yes, it worked. I think that our Fortiweb Reverse Proxy blocked the full attack and only the malicious mails were created. So we were lucky in this case.

        Best regards,

        Bernd

Resources