Baitaphish
Security intelligence
SearchLatest briefing
Curated incident record

ProxyLogon exploitation of Microsoft Exchange Server (HAFNIUM and widespread scanning)

In early 2021, multiple vulnerabilities in Microsoft Exchange Server were exploited at scale, with Microsoft attributing early activity to the actor it tracked as HAFNIUM and subsequent widespread opportunistic exploitation. CISA issued a joint advisory describing the exploitation chain, victim impact, and remediation actions, including patching and web shell detection. The episode drove urgent patching across on-premises Exchange deployments and illustrates the financial and operational risk created by rapidly exploited internet-exposed enterprise services.
First reported March 2, 2021Vuln Exploitationhigh overall confidence
Incident library
First reportedMarch 2, 2021
ActivityMarch 1, 2021
Last updatedFeb 2, 2026, 12:00 AM UTC
Record confidencehigh

Key facts

Affected

  • Organizations running on-premises Microsoft Exchange Server
  • Government and private sector organizations targeted by exploitation and web shell deployment

Initial access

  • vuln

Impact

  • data_theft
  • service_disruption
  • financial_loss
  • unknown

Attribution

HAFNIUM (initial activity) and multiple actors (subsequent exploitation) high confidence

Microsoft and CISA described HAFNIUM involvement and broader follow-on exploitation by additional actors.

CVEs and ATT&CK

CVEs

CVE-2021-26855 · highCVE-2021-26857 · highCVE-2021-26858 · highCVE-2021-27065 · high
  • T1190: The incident involved exploitation of a public-facing application (Exchange Server) to gain initial access.
  • T1505.003: CISA and Microsoft described web shells being placed on vulnerable Exchange servers during exploitation.

Mitigations

Now

  • Patch/upgrade Microsoft Exchange Server to a fixed versionCloses the specific weakness used for initial access and reduces the window for opportunistic exploitation.

Soon

  • Restrict or remove direct internet exposure for the affected serviceReduces the attack surface and limits repeat exploitation while validation and remediation are underway.

Later

  • Implement rapid vulnerability response SLAs and external attack-surface monitoringImproves time-to-patch and helps detect newly exposed assets or known-vulnerable versions before attackers do.

Detection ideas

Detect exploit attempts in web/WAF logs

Look for request paths/parameters and user agents matching published IOCs for the exploited vulnerability; alert on spikes from new source IPs.

Data sources: WAF logs, Reverse proxy logs, Web server access logs

Alert on suspicious web server child processes / web shells

Alert when web server processes (w3wp/httpd/nginx) spawn shells or write new executable/script files into web directories (e.g., *.aspx, *.jsp, *.php).

Data sources: EDR telemetry, Process creation logs, File creation events

Sources