In January 2021, attackers exploited four previously unknown vulnerabilities in on-premises Microsoft Exchange Server versions 2010, 2013, 2016, and 2019. DEVCORE reported the flaws to Microsoft on January 5, and Volexity detected an intrusion on January 6. The exploits enabled attackers to bypass authentication, gain administrator privileges, upload code, and install web shells that provided persistent access to email, passwords, calendars, and connected networks. By March 9, Microsoft and security researchers estimated that roughly 250,000 servers had been compromised, including about 30,000 organizations in the United States, 7,000 servers in the United Kingdom, the European Banking Authority, and Norway’s Parliament.
Microsoft attributed the initial campaign to Hafnium, which it described as a China-based, state-sponsored group, while China denied the allegation. On July 19, 2021, the United States, United Kingdom, European Union, NATO, and other allies publicly attributed the exploitation with high confidence to malicious actors affiliated with China’s Ministry of State Security. Microsoft issued emergency patches on March 2, CISA ordered U.S. government networks to apply them on March 3, and Microsoft released a mitigation and web-shell detection tool on March 15. Patching did not remove backdoors already installed; attackers later deployed DearCry ransomware and other malware, exposing the broader security risks of unsupported or poorly maintained on-premises infrastructure.
