Kaspersky GERT reported that NightEagle (APT-Q-95) expanded its operations from Asia to Russian businesses, using stolen VPN credentials, GhostContainer on Microsoft Exchange, and multiple tunneling and lateral-movement techniques. The campaign also involved BlueKeep exploitation, DCSync-related activity, and tooling hosted under disguised GitHub repositories to maintain access and move across internal networks. #NightEagle #APTQ95 #GhostContainer #MicrosoftExchange #BlueKeep #DCSync

Microsoft is raising minimum version requirements in September to throttle and block emails sent from outdated Exchange servers.

📰 Source : LeMagIT — Article publié le 26 août 2026, relatant une vulnérabilité Exchange divulguée lors du Patch Tuesday de Microsoft du 11 août 2026. 🔍 Contexte : Le Patch Tuesday d'août 2026 de Microsoft est décrit comme le plus volumineux à ce jour, couvrant 421 vulnérabilités, dont 7 affectant Microsoft Exchange.

Corporate email can fall into an attacker's hands after the compromise of a single low-privilege account. Nearly 22,000 internet-facing Microsoft Exchange servers have not received the fix for CVE-2026-62911, a flaw that allows every employee's mailbox to be seized. An Authentication Bypass by Capture-Replay Microsoft rated the vulnerability 8.0 out of 10 on the CVSS 3.1 scale and classified it as an authentication bypass by capture-replay.

Nearly 22,000 Microsoft Exchange servers are still unpatched against CVE-2026-62911, a critical authentication bypass flaw that can let an authorized attacker elevate privileges over the network. The United States and Germany have the highest numbers of vulnerable servers, while NCSC-NL and BSI have urged immediate patching as a working exploit is reportedly circulating online. #CVE-2026-62911 #MicrosoftExchangeServer #NCSC-NL #BSI #OrangeTsai #DEVCOREResearchTeam #TrendMicroZeroDayInitiative

A public PoC is available for Microsoft Exchange CVE-2026-62911 while nearly 22,000 Internet-facing Exchange servers remain vulnerable.

The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.

Laundry Bear, also tracked as Void Blizzard and TA488, is using the CVE-2026-42897 Outlook Web Access XSS flaw in half-click email attacks to deliver the OWAReaper backdoor. The campaign targets government and industry organizations across the U.S. and Europe and uses advanced persistence, credential theft, and multi-channel command-and-control to maintain long-term mailbox access. #LaundryBear #VoidBlizzard #TA488 #CVE-2026-42897 #OWAReaper #MicrosoftExchange #OutlookWebAccess

Microsoft is working to resolve an ongoing Exchange Online issue that has been mistakenly quarantining customers' mailboxes since Sunday. [...]

Microsoft has reminded customers that it will stop shipping security updates for Exchange 2016 and 2019 through the Extended Security Update (ESU) program in October.

Microsoft has delayed Exchange Online PowerShell's credential cutoff to December 2026, while scripts using stored passwords could break after module updates.