Microsoft warns users a new Chinese state-sponsored threat actor is exploiting four previously undisclosed zero days in Exchange Server; patches are available
Microsoft is warning customers that a new China state-sponsored threat actor is exploiting four previously undisclosed security flaws …
Context & Ripple Effects
Microsoft’s disclosure and patches arrived before the Exchange flaws became a wider operational problem: related coverage soon documented at least ten, mostly state-backed groups exploiting the vulnerabilities across thousands of servers in more than 115 countries.
The episode also sits within a recurring Microsoft enterprise-software exposure pattern, with later reporting on actively exploited Exchange zero-days and Chinese state-linked exploitation of SharePoint flaws.
First-order effects
- Exchange Server administrators must apply Microsoft’s patches against four flaws already being used by a Chinese state-sponsored actor, making patch deployment an immediate security priority.
- Microsoft must support customers through remediation while its disclosure establishes the affected Exchange software as an active intrusion target.
Second-order effects
- The broader exploitation documented by ESET means organizations cannot treat patching as sufficient evidence of safety; security teams must also assess whether their Exchange servers were already compromised.
- Repeated exploited-zero-day reports put greater pressure on Microsoft’s enterprise customers to accelerate update and incident-response processes for externally exposed collaboration systems.
Third-order effects
- If Exchange and SharePoint continue to draw state-linked zero-day activity, Microsoft’s on-premises enterprise software will require more continuous defensive operations rather than periodic maintenance cycles.
- The pattern reinforces a market in which vulnerability intelligence and rapid remediation become core requirements for organizations operating business-critical messaging and collaboration infrastructure.
The trend: State-linked actors are repeatedly targeting widely deployed Microsoft enterprise services, raising the premium on rapid patching and post-compromise investigation.
Related: Dual-use code intelligence · Microsoft · Exchange · ESET reports broad Exchange exploitation · Microsoft confirms exploited Exchange zero-days
Related Coverage
- HAFNIUM targeting Exchange Servers with 0-day exploits Microsoft Security · Eric Avena
- New nation-state cyberattacks — Tom Burt - Corporate Vice President, Customer Security & Trust Microsoft On the Issues · Tom Burt
- Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities Volexity
- Multiple Security Updates Released for Exchange Server Microsoft Security …
- Microsoft patches Exchange software flaws targeted by Chinese hackers Engadget · Mariella Moon
- URGENT — 4 Actively Exploited 0-Day Flaws Found in Microsoft Exchange The Hacker News · Ravie Lakshmanan
- Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails Krebs on Security · Brian Krebs
- Microsoft warns customers against new China cyber attack on exchange email Business Standard · Ians
- View article HotHardware.com News
- View article BleepingComputer
- View article International Business Times
- View article Windows Central
- View article Graham Cluley
- View article HealthITSecurity
- Microsoft issues emergency patches for 4 exploited 0-days in Exchange Ars Technica · Dan Goodin
- Released: March 2021 Exchange Server Security Updates Microsoft Tech Community
- Microsoft reveals Chinese hack targeting Microsoft Exchange AppleInsider · William Gallagher
- View article TechRadar
- Microsoft Warns of Chinese Hackers Targeting Email Product Wall Street Journal · David Uberti
- Microsoft says a group of cyberattackers tied to China hit its Exchange email servers CNN · Michelle Toh
- Microsoft warns that Chinese hackers are targeting vulnerabilities in Exchange Server SiliconANGLE · Duncan Riley
- Microsoft: Chinese Hackers Have Been Exploiting Our Email Product to Steal Data Gizmodo · Lucas Ropek
- Four zero-days in Microsoft Exchange actively exploited in the wild Security Affairs · Pierluigi Paganini
- Microsoft says Chinese hacking group targeting security flaws in business email app The Hill · Tal Axelrod
- Microsoft fixes four zero-day flaws in Exchange Server exploited by China's ‘Hafnium’ spies to steal victims' data The Register · Simon Sharwood
- Microsoft Exchange Server Attacked By Chinese Hackers CRN · Michael Novinson
- Microsoft release out of band patch for Exchange Server which admins need to apply urgently MSPoweruser · Surur
- Microsoft: Chinese Hackers Are Exploiting Exchange Server Flaws to Steal Emails PCMag · Michael Kan
- Urgent patches out for exploited Exchange Server zero-days iTnews · Juha Saarinen
- Microsoft fixes actively exploited Exchange zero-day bugs, patch now BleepingComputer · Lawrence Abrams
- Microsoft: Chinese APT Targeted Exchange Servers With Four Zero-Days The Record · Catalin Cimpanu
- Microsoft Fixes Exchange Server Zero-Days Exploited in Active Attacks Dark Reading · Kelly Sheridan
- Microsoft Issues Critical Update Warning As Chinese Hackers Attack Exchange Servers Forbes · Davey Winder
- Microsoft: These Exchange Server zero-day flaws are being used by hackers, so update now ZDNet · Liam Tung
- On-premises Exchange servers are under attack from a state-sponsored group Neowin · Usama Jawad
Discussion
-
@volexity
@volexity
on x
Volexity has identified multiple 0-day exploits in Microsoft Exchange resulting in authentication bypass and RCE. Actively exploited in the wild since at least January 2021. More here: https://www.volexity.com/... #threatintel #dfir #infosec https://twitter.com/...
-
@gossithedog
Kevin Beaumont
on x
Four chained zero days are being exploited in the wild against Exchange Server, aka Outlook Web App. *Patches available now, action required to apply* Full remote code execution, without authentication. https://www.microsoft.com/...
-
@zackwhittaker
Zack Whittaker
on x
New: Microsoft says a new state-sponsored threat group operating out of China, called Hafnium, is exploiting four zero-days targeting Exchange enterprise email servers. https://techcrunch.com/...
-
@stevenadair
Steven Adair
on x
Our team has been tirelessly working several intrusions since January involving multiple 0-day exploits in Microsoft Exchange. We've released the details of this threat activity alongside Microsoft's Out of Band patch. Take a look and update Exchange! https://www.volexity.com/...
-
@pyrotek3
Sean Metcalf
on x
Still running Exchange on-prem? This type of issue may push the shift to Microsoft Office 365. Compromise of on-prem Exchange often quickly results in compromise of Active Directory. Securing Exchange on-prem includes all related components: archive, backup, load balancer, etc. h…
-
@ryanaraine
Ryan Naraine
on x
Here's the doc you want to read on the new Microsoft Exchange Server in-the-wild 0day attacks https://www.volexity.com/...
-
@spierenburg
Sander
on x
“This vulnerability is remotely exploitable and does not require authentication, nor does it require any special knowledge or access to a target environment. The attacker only needs to know the server running Exchange and what account from which they want to extract e-mail.” http…
-
@briankrebs
@briankrebs
on x
Microsoft today released emergency updates to plug 4 security holes in Exchange Server 2013-19. Microsoft and others say a previously unidentified Chinese cyber espionage group is using the flaws to plunder email communications at targeted organizations. https://krebsonsecurity.c…
-
@josephmenn
Joseph Menn
on x
One two three FOUR Exchange 0days in use by probably China. Patch now or forever hold your peace. https://twitter.com/...
-
@ryanaraine
Ryan Naraine
on x
Shoutout to Volexity. Incredible work 🏆 https://twitter.com/...
-
@anthomsec
Andrew Thompson
on x
Patch, and look for intrusion activity. It's not enough to just patch. https://twitter.com/...
-
@thebookofdoodle
Derek Martin
on x
Running Exchange on prem? This is a big effing deal - patch. right. now. (O365 not impacted) https://twitter.com/...
-
@kimzetter
Kim Zetter
on x
Volexity has post about how it discovered the active exploitation of the 4 zero-day vulns Microsoft is patching today. “These attacks appear to have started as early as January 6, 2021.” https://www.volexity.com/...
-
@stevenadair
Steven Adair
on x
We have updated our blog to include additional indicators that we have seen from the attackers exploiting the Exchange 0-days. This includes post-exploitation tools, interesting or unique User-Agent strings, and IP addresses seen in recent attacks. https://www.volexity.com/... ht…
-
@gossithedog
Kevin Beaumont
on x
Also; if you have SIEM or network logs, check for activity from IPs at end of this post to your OWA servers, particular in past week. Shell spray. https://www.volexity.com/...
-
@x0rz
@x0rz
on x
Apply patches, but most importantly look for IOCs on your Exchange servers https://twitter.com/...
-
@andrew___morris
Andrew Morris
on x
TL;DR the IPs that @Volexity called out in their report slinging the #OWA 0day are still active and scanning and crawling the Internet literally right this very second. https://twitter.com/...
-
@likethecoins
Katie Nickels
on x
The Microsoft and Volexity blog posts are full of detection opportunities and forensic artifacts. Even if you don't use MS products, you can translate these queries. https://www.microsoft.com/... https://www.volexity.com/... https://twitter.com/...