Forum Discussion

Copper Contributor

Sep 30, 2021

hello darkness my old friend worrying emails in draft

hi everyone, we run on premise exchange 2019 and outlook clients keep showing a email message in Draft folder with content - "hello darkness my old friend" server is fully patch with latest cu but m...

exchange 2019

James1

Brass Contributor

Oct 04, 2021

BerndW For us we indeed notice some webhooks under the Program Files, applicationHost.config has been altered aswell - there been virtual directories added. We deleted those, fully patched the server, did multiple MSRT full scans. After that the mails in the draft still apeared.

We fully deleted those mails from user boxes via

Get-Mailbox | Search-Mailbox -SearchQuery 'attachment:FileAttachment.txt' -DeleteContent

You can check if you have those emails here

Get-Mailbox | Search-Mailbox -SearchQuery 'attachment:FileAttachment.txt' -EstimateResultOnly | Select-Object -Property Identity, ResultItemsCount

After deletion those emails are no longer appearing, however were still monitoring, also a fresh Exchange server is in the works.

BerndW

Copper Contributor

Oct 04, 2021

Hi James,

thanks for your info and the powershell commands. I'll let our customer run both. I'm still hoping that we don't have to reinstall the cluster.

Best regards,
Bernd

albsej
Copper Contributor
Nov 28, 2021
BerndWHi, did it work on you, where did you run the command, is it from the Exchange server or in the user computer? Thanks for the reply 🙂
- BerndW
  Copper Contributor
  Nov 28, 2021
  albsej Hi, the command has to be run inside an exchange management shell. And yes, it worked. I think that our Fortiweb Reverse Proxy blocked the full attack and only the malicious mails were created. So we were lucky in this case.
  Best regards,
  Bernd