A critical moment for on-premises Exchange
In March 2021, I wrote about attacks exploiting vulnerabilities in on-premises Microsoft Exchange. Microsoft’s initial reporting associated a campaign with HAFNIUM and later described exploitation by additional actors. The affected on-premises releases and their required updates depended on the specific build; Exchange Online wasn’t affected by those vulnerabilities.
Use Microsoft’s original advisory and responder links for the documented timeline. The old CU19 and KB5000871 references in my article are historical, not a universal update recipe for every Exchange server.
Patching doesn’t remove every consequence
Closing the entry point and determining whether an attacker already gained access are different jobs. A web shell or another persistence mechanism can remain after the vulnerable software is updated.
My original investigation described unfamiliar files in web-accessible directories, staged downloads, encoded PowerShell, scheduled tasks, and attempted network or firewall changes. Those were observations from a particular investigation, not proof that every affected server contained the same files or that all activity belonged to one group.
Preserve evidence before cleanup
The original instruction to delete suspicious files immediately was incomplete. Isolate and investigate under an incident-response plan, preserve relevant logs and samples, and assess account access and lateral movement. Removing a visible file doesn’t prove an environment is clean.
Temporarily restricting a public endpoint can reduce exposure but may interrupt Outlook web access and other services. Coordinate containment with the people responsible for the system.
An important correction about PowerShell
Invoke-Expression executes a string as code. It is not a safe decoding mode. Running unknown content on Linux also doesn’t make it harmless. Analyze samples as data in a controlled environment without executing or contacting their embedded destinations.
Scanning is one part of the investigation
Microsoft published detection and investigation resources during the incident. A clean scan is useful evidence, but it isn’t a guarantee that no compromise occurred. Recovery may require broader remediation, credential changes, or rebuilding affected systems based on the findings.
This article preserves a 2021 incident account with those corrections. It is not a claim that the old tools alone provide a complete response today.
Images from the original article
