Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
A staggering figure published in an announcement on a well-known underground forum is attracting the attention of the cyber security community. A user with the nickname Orcinus orca claims to be in possession of a rare zero-day vulnerability capable of compromising the core infrastructure of Microsoft 365. The user is then auctioning off what is described as a Pre-Authentication Server-Side Request Forgery (SSRF) exploit that can provide initial access to systems without any authentication.
According to reports, the exploit can target the global Exchange Online infrastructure by exploiting a mechanism of protocol-level desynchronization. This security bug allows bypassing Microsoft’s internal gateways. Additionally, the author of the post claims to have obtained session cookies and induced the infrastructure to process requests intended for users, hypothesizing scenarios of interception and compromise of accounts.
The post describes particularly severe impacts, including network segmentation bypass, Web Application Firewall bypass, and even the possibility of executing zero-click attacks, i.e., without any interaction from the victim.
The requested price, as mentioned at the beginning, is staggering: it starts at $1 million as the base bid and $2.5 million for an immediate purchase, with payment exclusively in Monero (XMR).
As happens in the underground world, it is necessary to maintain a cautious approach. There are no independent confirmations that demonstrate the actual existence of this rare security bug, nor has Microsoft released any communications confirming a compromise of its infrastructure.
We can say that it is very common for cybercriminals to exaggerate or falsify the capabilities of their exploits to increase their commercial value. However, even when an announcement is unfounded, the appearance of offers of this level represents an indicator of interest in cloud infrastructures, especially in hyperscalers’ cloud infrastructures.
If this exploit were really functional, potential buyers would likely be the so-called Initial Access Brokers (IAB), in addition to nation-states and national intelligence. This is a central figure in the cybercrime economy, which we have discussed several times on these pages.
They are groups specialized in detecting security bugs (both known and 0-day, as in this case) within corporate networks, cloud services, or privileged accounts and then reselling such access to other criminal groups.
In practice, they represent the first link in the attack chain. Once a Microsoft 365 environment is compromised, access could be sold to ransomware operators, data theft groups, Business Email Compromise (BEC) campaigns, or state-sponsored actors interested in cyber espionage activities.
