HAFNIUM Exchange Server Exploitation
March 2021 exploitation of four Microsoft Exchange Server zero-days (CVE-2021-26855 and related) by the China-linked HAFNIUM group against on-premises email infrastructure.
In March 2021, the China-linked HAFNIUM actor chained four Microsoft Exchange Server zero-days (ProxyLogon, CVE-2021-26855 and related) to deploy webshells on tens of thousands of on-premises mail servers globally.
Definition
Exploitation of Exchange Server SSRF plus improper authorization/deserialization (CVE-2021-26855/26856/27065/26857, ProxyLogon) to authenticate as SYSTEM and write webshells for persistent mailbox access.
Why It Matters / Impact
Tens of thousands of on-premises Exchange servers compromised worldwide; CISA KEV added the exploited CVEs within days; drove urgent patching guidance and webshell-hunting instructions.
Current Status
- Review status: published
- Last updated: 2026-08-26
- Evidence: 2 source(s) · 4 CVE(s) linked
- Confidence: 94%
Threat Actors
Timeline
- 2021-02-01 — Campaign begins against Exchange mailboxes (approx.)
- 2021-03-02 — Microsoft discloses HAFNIUM and four zero-days
- 2021-03-02 — Out-of-band Exchange Server updates; CISA emergency directive 21-02
Sources
Start Investigation
Move from reading to investigating HAFNIUM Exchange Server Exploitation. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about HAFNIUM Exchange Server Exploitation?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.
Recommended Tools
- IOC LookupSearch OpenTrojan intelligence for indicators tied to this campaign.Look up IOC
Every tool runs passively or locally — inputs are never stored and no target is scanned. Start an investigation on this entity →