"Ghost-Sender" Vulnerability Affecting Hybrid Exchange On-Premises

Reporting by CERT Bulgaria WarningsRead the original at govcert.bg

Executive Summary

The "Ghost-Sender" vulnerability exploits configuration weaknesses within organizations utilizing Exchange Online or hybrid Exchange setups, allowing for the fraudulent sending of emails that evade standard security checks like SPF, DKIM, and DMARC. This risk materializes when an organization uses a third-party email gateway for its MX records but maintains open pathways for direct external connections to Exchange Online. Attackers can bypass perimeter defenses by using PowerShell or custom SMTP commands to deliver mail directly to the tenant endpoint. These spoofed emails can appear highly legitimate, even carrying internal profile pictures, facilitating sophisticated phishing campaigns targeting HR or Finance departments—for instance, redirecting payroll payments or tricking users into installing malware. Mitigation involves several layered technical controls: disabling "Direct Send," rigorously restricting "Partner organization" connectors via IP/certificate whitelists, and implementing high-priority transport rules to quarantine unapproved inbound traffic.

Facts Only

Organizations vulnerable to Ghost-Sender use Exchange Online or hybrid Exchange configurations.
The domain's MX records must not point solely to Microsoft (*.mail.protection.outlook.com).
MX records can be pointed to a third-party email gateway, spam filter, or local mail server.
Vulnerability exists if the "Partner Organization" connector lacks strict IP or certificate restrictions.
A security measure may involve a "priority-0 transport" rule for rejecting external mail from unapproved paths.
Malicious actors bypass SEGs by delivering emails directly to Exchange via PowerShell or custom SMTP commands.
Attackers can impersonate internal staff, such as HR or Finance personnel.
Spoofed identities can utilize current corporate profile pictures to increase perceived legitimacy.
Three mitigation steps include disabling "Direct Send," configuring wildcard Partner organization connectors with restrictions, and applying Priority 0 transport rules.

Full Take

The fundamental premise exposed here is that digital trust architectures are built upon layered assumptions: the perimeter must be hardened (the SEG), and identity must be proven at ingress (SPF/DKIM). Ghost-Sender reveals a failure in the orchestration between these layers; when direct administrative access to the endpoint bypasses the gatekeepers, all preceding authentication protocols become functionally moot for the attacker. The narrative strongly suggests that security efficacy is not about implementing necessary tools, but meticulously defining the acceptable paths *between* them. Furthermore, the attack vector described—impersonating lower-level employees (HR/Finance) rather than solely executives—shifts the psychological focus from high-stakes corporate espionage to transactional manipulation (salary redirection), indicating a highly sophisticated, low-friction social engineering model designed for maximum procedural disruption over singular data theft. The reliance on specific technical controls like "priority-0 transport" versus general filtering underscores that resilience here is less about achieving "perfect security" and more about enforcing absolute process governance at the routing level.
The unstated assumption driving this risk profile is that human administrators will configure connectors and policies based solely on best practices rather than threat modeling every possible ingress point as hostile. The historical echo here is any digital system where an explicit, trusted back door (like a poorly constrained connector) offers administrative bypass capabilities regardless of front-line defense posture.
What structural blind spot allows technical controls meant to enforce external trust to be subverted by direct endpoint manipulation? If governance mandates define success solely based on perimeter filtering, how vulnerable are the *internal* operational assumptions when pathways exist for direct API or SMTP entry? Does this model imply that a truly resilient system must operate under an assumption of total network compromise rather than assuming layered defense effectiveness?
Patterns detected: none

From the original · CERT Bulgaria Warnings

"Ghost-Sender" is a vulnerability manifested in a widespread configuration error that allows for the falsification of emails to organizations using Exchange Online tenants or hybrid Exchange Onprem -> Exchange Online configurations.

Read the full story at govcert.bg

Sentinel — Human

Confidence

This text reads as a highly specialized technical disclosure from an industry expert, meticulously outlining a specific email security vulnerability and its countermeasures. The writing structure aligns with detailed threat intelligence rather than generalized AI summarization.

Signals Detected

Variable sentence structure relating to technical escalation (introduction -> list -> mechanism details)

Strong, logical flow mapping vulnerability to execution methods and mitigation steps.

Clear progression from defining the problem (Ghost-Sender) to listing prerequisites, attack vectors, impact, and solutions.

All claims are presented as technical conditions or recommended practices derived from industry standards.

Human Indicators

The language uses specific, jargon-heavy operational sequences ('deliver personally,' 'transport commands') common in expert cybersecurity disclosures.

The progression of the attack narrative (impersonating low-level staff first, then escalating threats) suggests strategic human framing.