2021Vulnerability exploitationEspionage
Microsoft Exchange ProxyLogon exploitation
Disclosed 2 March 2021
Microsoft released emergency patches for four chained zero-day vulnerabilities in on-premises Exchange Server, often referred to as ProxyLogon, that let attackers take over servers and plant web shells. After disclosure, many other groups raced to exploit unpatched servers. CISA issued an emergency directive requiring federal agencies to patch or disconnect.
- Victim
- Organisations running on-premises Microsoft Exchange Server
- Sector
- Cross-sector
- Public attribution
- Microsoft attributed the initial exploitation to HAFNIUM, which it assessed as state-sponsored and operating out of China; in July 2021 the UK and allies attributed the Exchange compromise to Chinese state-backed actors.
Impact
Large numbers of internet-facing Exchange servers worldwide were compromised before and after patches were released (CISA, Microsoft).
Root cause
Zero-day vulnerabilities in an internet-facing email server, then slow patching that left servers open to mass exploitation.
Lessons learned: the controls it teaches
- Patch internet-facing servers within hours when exploitation is active, or take them offline.
- After patching, hunt for web shells; patching does not remove an existing compromise.
- Consider whether self-hosted, internet-facing services can be reduced or moved.