<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
A few days ago, ReliaQuest reported that hackers had used ArcGIS Enterprise/Server to gain persistent access to a network using a custom Server Object Extension (SOE). This SOE allowed the hackers to gain high level access to the system in a way that not even
a full system recovery could stop or fix. The SOE was not the initial source of the intrusion. It, however, acted as a gateway to pass information and maintain long term access to the network and its resources beyond just those associated directly with ArcGIS
Enterprise.</div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
ReliaQuest said "The attackers activated the malicious SOE using a standard [JavaSimpleRESTSOE] ArcGIS extension, invoking a REST operation to run commands on the internal server via the public portal making their activity difficult to spot. By adding a hard-coded
key, the hackers prevented other attackers, or even curious admins, from tampering with its access." The hackers were able to deploy this SOE using a public facing portal administrator account. </div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
According to Esri, this was possible because the client impacted by this hack did not follow Esri ArcGIS Enterprise Hardening best practices as documented in their
<a style="margin: 0px;" data-linkindex="0" data-auth="NotApplicable" title="https://content.esri.com/resources/enterprisegis/arcgis_enterprise_hardening_guide.pdf" class="x_OWAAutoLink" id="OWAaf2c6f65-6db5-21bd-52a3-24c23f56570c" href="https://content.esri.com/resources/enterprisegis/arcgis_enterprise_hardening_guide.pdf">
ArcGIS Enterprise Hardening Guide</a>. Some things Esri specifically mentions that could have prevented this hack</div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<ul style="margin-top: 0px; margin-bottom: 0px; list-style-type: disc;" data-editing-info="{"applyListStyleFromLevel":true}">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div style="margin: 0px;" role="presentation">Use Multifactor Authentication (MFA)</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div style="margin: 0px;" role="presentation">Make sure to manage permissions and not grant more privileges than needed to any user</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div style="margin: 0px;" role="presentation">Block Management interfaces from direct internet access per their
<a style="margin: 0px;" data-linkindex="1" data-auth="NotApplicable" title="https://trust.arcgis.com/en/customer-documents/ArcGIS_Enterprise_Web_Application_Filter_Rules.pdf" class="x_OWAAutoLink" id="OWA83ce363a-061b-1a52-8971-abb8eb7ca01d" href="https://trust.arcgis.com/en/customer-documents/ArcGIS_Enterprise_Web_Application_Filter_Rules.pdf">
Web Application Filter (WFA) rules</a></div>
</li></ul>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
This is not an issue that will automatically impact ArcGIS Enterprise users. If you are following Esri recommended best practices you should be safe from this type of attack. At least as much as anyone can be. This just shows how hackers can be creative and
with enough time can find a way in. For more information I have included links to the article which contains ReliaQuest findings and the one from Esri responding to those finding if you want some more information. I would suggest you review your security settings
to ensure they do comply with Esri best practices. </div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<a style="margin: 0px;" data-linkindex="2" data-auth="NotApplicable" title="https://thehackernews.com/2025/10/chinese-hackers-exploit-arcgis-server.html" class="x_OWAAutoLink" id="OWA44f359f3-f905-f047-4314-d9730a49b758" href="https://thehackernews.com/2025/10/chinese-hackers-exploit-arcgis-server.html">Chinese
Hackers use ArcGIS Server as Backdoor for over a year</a><a style="text-decoration: none; margin: 0px;" data-linkindex="3" data-auth="NotApplicable" title="https://thehackernews.com/2025/10/chinese-hackers-exploit-arcgis-server.html" class="x_OWAAutoLink" id="OWAc9ed2e22-24cd-0476-646d-66dd35d7b61e" href="https://thehackernews.com/2025/10/chinese-hackers-exploit-arcgis-server.html"> </a>-
ReliaQuest report article</div>
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<a style="margin: 0px;" data-linkindex="4" data-auth="NotApplicable" title="https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/understanding-arcgis-server-soe-compromise" class="x_OWAAutoLink" id="OWAf05b1f24-4748-1f6e-5e66-83b6ad9e4dc7" href="https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/understanding-arcgis-server-soe-compromise">Understanding
ArcGIS Server SOE Compromise</a> - Esri Response</div>
<div style="margin: 0px;" class="elementToProof" id="x_x_Signature">
<div style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div class="elementToProof" id="Signature">
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;" class="elementToProof">
<span style="color: black;">Tripp Corbin, MCP, GISP</span></p>
<p style="background-color: white; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;" class="elementToProof">
<span style="font-size: 11pt; color: rgb(32, 31, 30);">Senior GIS Professional, Consultant, & Instructor</span></p>
<p style="background-color: white; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;" class="elementToProof">
<span style="font-size: 11pt; color: rgb(32, 31, 30);">Cultivate Geospatial Solutions</span></p>
<p style="background-color: white; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;" class="elementToProof">
<span style="font-size: 11pt; color: rgb(5, 99, 193);"><u><a style="color: rgb(5, 99, 193); margin-top: 0px; margin-bottom: 0px;" class="OWAAutoLink" id="OWA888fee71-bb65-8fa9-f07f-3a1ed724a611" href="https://www.cultivategeospatial.com/">Website</a></u></span><span style="font-size: 11pt; color: rgb(32, 31, 30);"> |
</span><span style="font-size: 11pt; color: rgb(70, 120, 134);"><u><a style="color: rgb(70, 120, 134); margin-top: 0px; margin-bottom: 0px;" title="https://www.linkedin.com/in/trippcorbin/" class="OWAAutoLink" id="OWAe023812a-b923-21e7-124a-e5408fe1e663" href="https://www.linkedin.com/in/trippcorbin/">LinkedIn</a></u></span></p>
<p style="background-color: white; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;" class="elementToProof">
<span style="font-size: 11pt; color: rgb(32, 31, 30);">(404) 861-8588</span></p>
<p style="background-color: white; margin: 1em 0in; font-family: Aptos, sans-serif; font-size: 12pt;" class="elementToProof">
<span style="font-family: Arial, sans-serif; font-size: 11pt; color: rgb(36, 36, 36);"><img style="width: 1.062in; height: 0.197in; margin-top: 0px; margin-bottom: 0px;" height="18" width="101" data-outlook-trace="F:1|T:1" src="cid:e3062844-c71d-456f-9773-c2eca8cba35b"></span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;" class="elementToProof">
<span style="color: rgb(0, 0, 0);"><img style="width: 373px; height: 153px; max-width: 985px; margin-top: 0px; margin-bottom: 0px;" height="153" width="373" id="image_0" data-outlook-trace="F:1|T:1" src="cid:d3bd02fd-223c-4006-8f48-313e1965e723"></span></p>
</div>
</body>
</html>