On March 2, 2021, Microsoft released emergency patches for four zero-day vulnerabilities in Exchange Server, its on-premises email platform used by hundreds of thousands of organizations worldwide. Microsoft attributed exploitation to a Chinese nation-state group it called Hafnium. The patches were released on a Tuesday instead of the normal Patch Tuesday cycle because the vulnerabilities were being actively exploited and the situation could not wait two weeks. By the time the patches were available, an estimated 250,000 Exchange servers globally had already been compromised.
The vulnerabilities, collectively called ProxyLogon, were a pre-authentication remote code execution chain: an attacker with no credentials and no prior access to the target network could send crafted HTTP requests to an Exchange server exposed to the internet, authenticate as any user, write a web shell to the server's filesystem, and execute arbitrary commands. The attack surface was enormous - Exchange is typically internet-facing, because email has to arrive from the internet. Within 72 hours of the patches' release, multiple other threat actor groups beyond Hafnium were scanning and exploiting unpatched servers at scale.
The Vulnerability Chain
ProxyLogon was not a single vulnerability but four, chained together. CVE-2021-26855 was the critical pre-authentication server-side request forgery (SSRF) flaw. Exchange's backend includes an HTTP proxy component that handles requests between different Exchange services. This proxy would forward requests to backend Exchange components, and the authentication for these forwarded requests was performed using a value in the request itself - specifically, the X-AnonResource-Backend and X-BEResource cookie values - rather than through proper session validation.
By crafting specific values in these cookies, an attacker could make Exchange's proxy authenticate the request as any Exchange user, including administrators, without knowing any credentials. This provided authenticated access to Exchange's backend services without credentials. CVE-2021-26855 alone provided SSRF - the ability to make authenticated requests to Exchange's internal components.
CVE-2021-26857 was a deserialization vulnerability in Exchange's Unified Messaging service. It could be combined with CVE-2021-26855 to execute code as SYSTEM. CVE-2021-26858 and CVE-2021-27065 were post-authentication arbitrary file write vulnerabilities that allowed an authenticated attacker to write files to arbitrary paths on the Exchange server. The combination allowed an unauthenticated attacker to write a web shell (a small script that executes commands on the server) to a publicly accessible directory - completing a full remote code execution chain.
Hafnium: The Initial Exploiter
Hafnium, the group Microsoft attributed with the initial exploitation, is assessed by US government agencies as operating in the interests of the Chinese government. The group had been using the zero-days for targeted espionage since at least January 2021, approximately six weeks before the patches were released. Their targets included infectious disease researchers, law firms, defense contractors, NGOs, and policy think tanks - profiles consistent with Chinese intelligence collection priorities.
Hafnium's exploitation was targeted and quiet during the pre-disclosure period. They compromised specific organizations, deployed specific payloads, and moved carefully to maintain access. The intelligence collection value of Exchange is high: email contains communications, attachments, calendar entries, and contacts that represent the most sensitive organizational communications. A compromised Exchange server gives an attacker visibility into an organization's internal email without requiring individual endpoint compromises.
Microsoft's decision to release emergency patches before Patch Tuesday was driven partly by the discovery that knowledge of the vulnerabilities had spread beyond Hafnium before the patches were ready. Security researchers with Devcore (who had discovered the vulnerabilities and responsibly disclosed them to Microsoft) later indicated that Microsoft had been aware of the vulnerabilities since January 2021 and had been working on patches for six weeks when the exploitation became known. During that six weeks, the vulnerability had apparently reached additional threat actors.
The Pile-On: When Zero-Days Go Public
The 72 hours after the March 2 patch release demonstrated what happens when a critical pre-authentication vulnerability in a widely deployed internet-facing service is disclosed with a readily available exploit. Within hours of the patches' publication, multiple threat actor groups were scanning the entire internet for unpatched Exchange servers and deploying web shells at scale.
By March 5, three days after the patches, security researchers estimated that at least 30,000 US organizations and 250,000 globally had been compromised. By March 12, Microsoft and CISA reported that at least ten different threat actor groups were actively exploiting the vulnerabilities. These groups ranged from Chinese APT groups (Hafnium and multiple others) to Iranian threat actors to criminal ransomware operators. The Dearcry ransomware appeared on compromised Exchange servers within days of the disclosure.
The pattern was consistent with what security researchers call the "patch gap" problem: when a vulnerability is disclosed and patches are released simultaneously, attackers who see the patches can reverse-engineer the vulnerability and exploit it against unpatched systems faster than most organizations can deploy patches. For internet-facing infrastructure like Exchange servers, the patch gap is a window during which hundreds of thousands of systems are vulnerable to attackers who can move faster than IT departments.
Web Shells and Dwell Time
The web shells installed by multiple threat actors during the exploitation window created a long-tail problem. Many organizations patched their Exchange servers promptly after March 2 but did not detect or remove web shells installed before they patched. A web shell in a publicly accessible directory on an Exchange server remains functional after patching - the patch closes the initial exploitation path but does not remove files already written to the server.
Organizations that had been compromised by Hafnium during the pre-disclosure targeted phase were at particular risk: Hafnium had operated quietly for weeks and had likely moved beyond the initial web shell to deeper persistence mechanisms, additional credential theft, and lateral movement within the target network. The web shell was the entry point, not the end state.
The dwell time problem - the period between initial compromise and detection - was significant. Security teams racing to patch after March 2 frequently overlooked forensic investigation of whether they had been compromised before patching. An organization that patched on March 3 might have been compromised on March 1 and have active web shells and additional implants on their Exchange server that would persist indefinitely after patching.
The ProxyShell Family
ProxyLogon was the first in a series of Exchange vulnerabilities discovered and named with the "Proxy" prefix. ProxyShell, a different authentication bypass and code execution chain in Exchange OWA, was disclosed at Black Hat in August 2021. ProxyToken (authentication bypass in the Notification feature) and ProxyOracle (padding oracle in OWA) followed. The pattern suggested that Exchange's architecture - with its layered proxy components, complex authentication flows, and legacy code from multiple product generations - contained a family of related vulnerabilities in its authentication and request handling logic.
The Exchange vulnerabilities drove significant migration from on-premises Exchange to Exchange Online (Microsoft's cloud service), which was not affected by these vulnerabilities. The argument that cloud services with centralized patch deployment are more resilient to this class of vulnerability than on-premises deployments was substantially strengthened by the ProxyLogon experience.