Threat Advisory: HAFNIUM and Microsoft Exchange zero-day
Summary: Microsoft released patches on March 2 for four Exchange Server vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065 - affecting Exchange Server 2019, 2016, 2013 and out-of-support 2010, disclosing they were being exploited by a previously unknown actor called HAFNIUM. Attacks are believed to date back to Jan. 6, 2021, starting with a server-side request forgery flaw (CVE-2021-26855) or stolen passwords, then using CVE-2021-26857 to execute as SYSTEM and CVE-2021-26858 and CVE-2021-27065 to upload webshells.
Bottom line: HAFNIUM targeted infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and NGOs, and after bypassing authentication could download messages from users' mailboxes - so an unpatched Exchange server is a direct path to your mail data.