Microsoft Exchange Server Attack Timeline
Summary: Four critical Microsoft Exchange Server zero-days (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) were publicly disclosed on March 2, 2021, when Microsoft released patches a week ahead of its planned March 9 date and attributed active exploitation to a China-based APT it named HAFNIUM. Unit 42's reconstructed timeline places the first known exploitation on Jan. 3, at least 58 days before the patch, and Palo Alto Networks Expanse telemetry estimated over 125,000 unpatched Exchange Servers worldwide as of March 8.
Key Takeaway: Initial estimates put compromised organizations in the tens of thousands, dwarfing the SolarStorm supply chain attack in victims and estimated global remediation costs, and patching does not undo access attackers already gained during the two-month window.