ProxyLogon: the Exchange hack that needed the FBI to clean up
HAFNIUM chained four Exchange zero-days, breaching some 30,000 organizations
The market's verdict: -4.0% on MSFT in the week after.
What actually happened
On March 2, 2021, Microsoft disclosed that state sponsored attackers were chaining four zero day flaws in on premise Exchange Server. Emergency patches landed the same day, but in the patch then scrape aftermath, an estimated thirty thousand US organizations and roughly a quarter million servers worldwide were breached and seeded with web shells: small businesses, hospitals, banks and local government email, raided at industrial scale. The FBI eventually obtained a court order to break into victims' servers and remove the shells itself, because the cleanup had outgrown everyone else. A security failure so large the government became the janitor.
This one is officially acknowledged.
They did it more than once
Same servers, a new suffix, eighteen months later.
Links
-
Acknowledgement
- Microsoft Security Blog (official)
-
Context
- BleepingComputer (publication)
↳ caused by Exchange ProxyLogon zero-days (CVE-2021-26855 family)
Timeline
- Mar 2, 2021 Confirmed First reports came in.
- Apr 13, 2021 Mitigated FBI court-authorized removal of web shells from victims' servers.