campaign · 1609459200000

Microsoft Exchange Server Zero-Day Exploitation

State-sponsored actors, notably Hafnium, actively exploited four zero-day vulnerabilities in on-premises Microsoft Exchange Servers to steal data and deploy web shells.

What happened

Beginning in early 2021, malicious actors, including a Chinese state-sponsored group tracked as Hafnium, began exploiting four zero-day vulnerabilities (ProxyLogon) in on-premises Microsoft Exchange Servers. The attackers used these vulnerabilities to gain unauthorized access to email accounts, exfiltrate data, and install web shells for persistent access. Following Microsoft's out-of-band patch release on March 2, 2021, exploitation escalated dramatically as other threat actors, including ransomware operators (e.g., DearCry), rapidly adopted the exploits to compromise unpatched systems.

Technical mechanism

The campaign leveraged a chain of four vulnerabilities: CVE-2021-26855 (SSRF), CVE-2021-26857 (insecure deserialization), CVE-2021-26858 (arbitrary file write), and CVE-2021-27065 (arbitrary file write). This allowed unauthenticated attackers to execute arbitrary code as SYSTEM and deploy web shells (e.g., China Chopper) for remote control.

Why it matters

The widespread exploitation of these zero-days compromised tens of thousands of organizations globally, demonstrating the systemic risk posed by vulnerabilities in ubiquitous enterprise communication platforms.

Impact

Tens of thousands of organizations worldwide, including government agencies, businesses, and nonprofits, were compromised. The attacks resulted in significant data theft and subsequent ransomware infections for many victims.

Response

Microsoft released emergency out-of-band patches and mitigation tools (e.g., EOMT). CISA issued Emergency Directive 21-02 mandating federal agencies to patch or disconnect vulnerable servers. The U.S. government formally attributed the initial activity to actors affiliated with the PRC Ministry of State Security.

Defensive lessons

  • Rapid patching of internet-facing infrastructure is critical to prevent exploitation by fast-moving threat actors.
  • Organizations must proactively hunt for indicators of compromise (IOCs) such as web shells, as patching does not remove existing infections.
  • Migrating to cloud-based email services can reduce the attack surface and operational burden of securing on-premises servers.

Evidence register

  1. Cybersecurity and Infrastructure Security Agency (CISA) — Mitigate Microsoft Exchange Server Vulnerabilities (verified)