--- title: 'Everything You Need to Know About the Microsoft Exchange Server Hack' url: 'https://blog.datum-consulting.com/blog/microsoft-exchange-server-hack' markdown: 'https://blog.datum-consulting.com/blog/microsoft-exchange-server-hack.md' date: '2021-03-18' description: 'Microsoft identified a pattern of zero-day exploits being used by a group of malicious actors, now known as HAFNIUM, to attack on-premises Microsoft Exchange Servers. While HAFNIUM has been known as a state-sponsored threat actor operating out of China to target entities in the United States for ex…' taxonomy: category: - blog tag: - cybersecurity - 'cyber attack' - malware - 'microsoft exchange server' month: - March archives_month: - mar_2021 archives_year: - '2021' --- # Everything You Need to Know About the Microsoft Exchange Server Hack [ Home ](https://blog.datum-consulting.com/) Everything You Need to Know About the Microsoft Exchange Server Hack ## [Everything You Need to Know About the Microsoft Exchange Server Hack](https://blog.datum-consulting.com/blog/microsoft-exchange-server-hack) 18th Mar 2021 [cybersecurity](https://blog.datum-consulting.com/tag:cybersecurity#body-wrapper) [cyber attack](https://blog.datum-consulting.com/tag:cyber%20attack#body-wrapper) [malware](https://blog.datum-consulting.com/tag:malware#body-wrapper) [microsoft exchange server](https://blog.datum-consulting.com/tag:microsoft%20exchange%20server#body-wrapper) Microsoft identified a pattern of zero-day exploits being used by a group of malicious actors, now known as HAFNIUM, to attack on-premises Microsoft Exchange Servers. While HAFNIUM has been known as a state-sponsored threat actor operating out of China to target entities in the United States for exfiltrating information about industries, infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs, it operates using leased virtual private servers (VPS) in the United States. In this blog, we will elaborate on HAFNIUM and zero-day exploits, and how to protect against them. ##### How Does the HAFNIUM Zero-Day Exploit Work? The sophisticated attack on on-premises Exchange Server happens in three steps. 1. The actor gains access to on-premises Exchange Servers either using stolen passwords or by exploiting vulnerabilities that had not yet been discovered, and disguises as someone who has legitimate access. 2. They then create a web shell to remotely control the compromised server. 3. Finally, they use remote access from a U.S-based private server to steal data from organizations whose Exchange Servers have been compromised. ##### How to Determine If Exchange Server Is Compromised by HAFNIUM? Microsoft has shared several resources, including indicators of compromise (IOCs), detection guidance, and advanced hunting queries to help customers investigate if their systems have been compromised by the HAFNIUM attack and implement proactive detections. Here are some methods to check if on-premises Exchange Servers have been compromised. - Run the script provided by the Microsoft Exchange Server team to get an inventory of the patch-level status of on-premises Exchange servers. - Scan the Exchange log files for HAFNIUM indicators of compromise (IOC) for addressing address performance and memory issues. - Check for suspicious web shell hashes, paths, or file extensions. ##### What to Do After HAFNIUM Zero-Day Exploits? Here are the immediate steps to be taken after the HAFNIUM zero-day exploits. - Take inventory of the on-premises Exchange Servers and apply the out-of-band updates for CVE-2021-26855, CVE-2021-26857, CVE-2021-27065, and CVE-2021-26858. - Scan the Exchange Server even if the patches have been applied, as the vulnerabilities could have been exploited as early as January 2021. - Monitor activity in Exchange Servers and endpoints. Post-exploit activities, such as the launching of PowerShell from web server applications, could mean that further steps are necessary. ##### Datum Consulting Can Help Fix HAFNIUM Zero-Day Vulnerabilities If your organization is using Exchange Server and needs assistance with investigation and patching for the HAFNIUM zero-day exploit we are available via [phone](tel:4144318726) or fill out the form below and we will provide you our consulting services. Additionally, we can even provide fully managed Exchange Server hosting services, or help you migrate to the always-updated Exchange Online service in the appropriate Microsoft 365 plan for better protection against such attacks in the future. [ Previous Post](https://blog.datum-consulting.com/blog/microsoft-teams-displays) [Next Post ](https://blog.datum-consulting.com/blog/teams-calling-updates) #### Related Posts - 100 [Backup Is Feeble Protection Against Ransomware](https://blog.datum-consulting.com/blog/backup-is-feeble-protection-against-ransomware "Backup Is Feeble Protection Against Ransomware") - 100 [Deconstructing Cybercrime: Top 10 Attack Methods Attackers Use](https://blog.datum-consulting.com/blog/10-cybercrime-methods "Deconstructing Cybercrime: Top 10 Attack Methods Attackers Use") - 100 [Cyber Risk Insurance: Choosing the Best Policy for Your Small to Medium-Sized Business](https://blog.datum-consulting.com/blog/cyber-risk-insurance "Cyber Risk Insurance: Choosing the Best Policy for Your Small to Medium-Sized Business") - 100 [October is Cybersecurity Awareness Month](https://blog.datum-consulting.com/blog/cybersecurity-awareness-month "October is Cybersecurity Awareness Month") - 100 [How Do Cybersecurity AI Platforms Work?](https://blog.datum-consulting.com/blog/cybersecurity-ai-platforms "How Do Cybersecurity AI Platforms Work?") [JOIN OUR NEWSLETTER](https://zc.vg/sf/bawK1) [PAY INVOICE ONLINE](https://datum.connectboosterportal.com/authentication/login) [![](https://blog.datum-consulting.com/modules/sidebar/Yubico.png)](https://www.pntra.com/t/SkNJTk5MT09DSEZMTExNQ0dPR0tNSw) #### Follow Us [](https://twitter.com/datumconsulting "Twitter")[](https://www.linkedin.com/company/datum-consulting/ "LinkedIn") "); #### Popular Tags #### Archives - [ 3 May 2022 ](https://blog.datum-consulting.com/archives_month:may_2022) - [ 3 March 2022 ](https://blog.datum-consulting.com/archives_month:mar_2022) - [ 3 February 2022 ](https://blog.datum-consulting.com/archives_month:feb_2022) - [ 2 January 2022 ](https://blog.datum-consulting.com/archives_month:jan_2022) - [ 1 December 2021 ](https://blog.datum-consulting.com/archives_month:dec_2021) - [ 2 November 2021 ](https://blog.datum-consulting.com/archives_month:nov_2021) - [ 2 October 2021 ](https://blog.datum-consulting.com/archives_month:oct_2021) - [ 1 September 2021 ](https://blog.datum-consulting.com/archives_month:sep_2021) - [ 3 August 2021 ](https://blog.datum-consulting.com/archives_month:aug_2021) - [ 2 July 2021 ](https://blog.datum-consulting.com/archives_month:jul_2021) - [ 4 June 2021 ](https://blog.datum-consulting.com/archives_month:jun_2021) - [ 2 May 2021 ](https://blog.datum-consulting.com/archives_month:may_2021) --- ## Navigation - Parent: [Home](https://blog.datum-consulting.com/index.md) - Previous: [Introducing Operator Connect and More Teams Calling Updates](https://blog.datum-consulting.com/blog/teams-calling-updates.md) - Next: [Microsoft Teams Displays Now Available!](https://blog.datum-consulting.com/blog/microsoft-teams-displays.md)