NSA warns Russia-linked Sandworm hacking group has been actively exploiting a now-patched flaw in Exim mail transfer agent since Aug., exposing ~2.5M servers
Operators of the roughly 2.5 million exposed Exim servers must apply the patch immediately and hunt for signs they were already compromised since August, when the exploitation window opened.
Sandworm loses access to the specific flaw once patched, but retains footholds on any server it breached during the months the vulnerability sat exploitable.
Second-order effects
Organizations that cannot keep pace with recurring Exim patch cycles face pressure to move email off self-managed MTAs and onto hosted providers, shrinking the population of exposed servers over time.
Attribution by NSA and allied agencies — following the Centreon findings — raises the cost of Sandworm operations and pushes defenders to treat intelligence-agency advisories, not vendor bulletins alone, as their patching trigger.
Third-order effects
If every Exim disclosure cycle leaves hundreds of thousands of servers unpatched for years, the structural problem shifts from individual flaws to who maintains critical open-source internet infrastructure, and whether governments fund or audit it.
Repeated state exploitation of shared internet plumbing hardens a norm where intelligence agencies act as de facto early-warning systems for civilian infrastructure, formalizing a defense role that sits outside traditional regulation.
The trend: State-linked groups led by Sandworm are turning widely deployed open-source internet infrastructure into a recurring attack surface, with intelligence-agency disclosures becoming the primary line of civil defense.
Sandworm Team, Russian GRU Main Center for Special Technologies actors, continue to exploit Exim mail transfer agent #vulnerability, CVE-2019-10149. Patch to the latest version to protect your networks. Learn more here: https://www.nsa.gov/... https://twitter.com/...
U.S. Accuses Russian Military Hackers of Attack on Email Servers The unusually public complaint showed that American spy agencies are becoming more aggressive in calling out Moscow's interference as the presidential election approaches. https://www.nytimes.com/...
I want your rampant speculation: by the end of 2020, will we see a dump or leak of a politically important person's emails, hacked via this particular exploit? https://www.nbcnews.com/...
A Russian hacking group tied to power-grid attacks in Ukraine, and other nefarious Kremlin operations is exploiting a vulnerability that allows it to take control of computers operated by the US government and its partners. https://arstechnica.com/...
The NSA publicly announced the Russian hackers who attacked the 2016 election are still active. So what is Trump going to do to protect the 2020 election from them? (That's known as a rhetorical question.) https://www.nbcnews.com/...
Russian GRU actors, Sandworm Team, are exploiting a #vulnerability present in unpatched Exim mail transfer agent software. Protect your networks by checking out the latest from @NSACyber https://twitter.com/...
The same Russian intelligence unit that leaked Democrats' files in 2016 is engaged in an ongoing email hacking campaign, the National Security Agency announced Thursday. via @kevincollier https://www.nbcnews.com/...
It's an act of war, & if we had a real govt that wasn't acting as treasonous puppets for the attacker, then they would treat it as such. https://twitter.com/...
One of the big questions I have about the NSA release is “why now?” The vuln was first exploited in the wild in June 2019 (days after release). The report claims that Sandworm has been exploiting it since August. So what changed that made it necessary to talk about this now? 1/ h…