Scourge · March 2 2021

The Scourge of ProxyLogon

Chronicle

On 2 March 2021 Microsoft released emergency patches for four Exchange Server zero-days that the China-based HAFNIUM group was using to plant web shells on mail servers. As soon as the patches were out, many other groups pounced, and tens of thousands of on-premises Exchange servers were compromised worldwide. In April the FBI removed, under court order, web shells left on hundreds of US servers.

Lesson learned

It showed that the gap between an emergency patch and mass exploitation can be hours, and that an on-premises mail server is a prime target.

Prayer of reparation

O Exchange, who exchanged mail and web shells alike, shorten our maintenance windows and lengthen our administrators' patience. Amen.

How it is remembered

Remembered by installing emergency patches the same day, hunting for web shells even after updating, and asking whether the mail server really needs to live in the server room.