Cybersecurity Briefing — Microsoft Exchange zero-days exploited by Hafnium
Microsoft disclosed on 2 March 2021 that four Exchange Server zero-days were being exploited by Hafnium, prompting out-of-band patches and global emergency response for on-prem email servers.
On 2 March 2021 Microsoft released out-of-band fixes for four Exchange Server vulnerabilities (including CVE-2021-26855) under active exploitation by the Hafnium threat group. Mass exploitation led to widespread web shell installation, requiring rapid patching and forensic triage.
Security teams should inventory on-prem Exchange instances, apply cumulative updates, hunt for web shells and Indicators of Compromise from Microsoft guidance, and isolate compromised servers while enabling EDR coverage.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook — Zeph Tech
Use Zeph Tech research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.