On March 2, 2021, Microsoft released emergency out-of-band patches for four critical vulnerabilities in Microsoft Exchange Server. The vulnerabilities - collectively called ProxyLogon after the primary exploit chain - allowed unauthenticated remote code execution on any internet-facing Exchange server. Within 72 hours of the patch release, over 30,000 organizations in the United States alone had been compromised. Within a week, the number exceeded 250,000 globally. It was one of the most destructive vulnerability disclosures in enterprise software history.
Microsoft attributed the initial exploitation to Hafnium, a Chinese state-sponsored threat actor. But the situation quickly became more complex: within days of the patch release, at least five other threat groups - including ransomware operators - were exploiting the same vulnerabilities. What had begun as a targeted espionage operation became a global mass exploitation event. Security researchers described it as watching a building catch fire as the occupants were being told to evacuate: thousands of organizations were being compromised faster than they could deploy the patches.
The Four Vulnerabilities
ProxyLogon is a chain of four vulnerabilities. The first (CVE-2021-26855) is a server-side request forgery (SSRF) vulnerability in Exchange's authentication mechanism that allows an unauthenticated attacker to bypass authentication entirely by sending a specially crafted HTTP request. This gives the attacker the ability to act as any Exchange user.
The second (CVE-2021-26857) is an insecure deserialization vulnerability that allows execution of arbitrary code as SYSTEM. The third (CVE-2021-26858) and fourth (CVE-2021-27065) are post-authentication arbitrary file write vulnerabilities that allow writing files to any path on the server. Together, the chain allows an unauthenticated attacker to execute arbitrary commands as SYSTEM on the Exchange server - the highest privilege level on Windows.
The exploitation process was simple: send the SSRF request to authenticate as an Exchange admin, use the insecure deserialization or file write to plant a web shell (a small script that accepts and executes commands via HTTP), and use the web shell for persistent access. The entire chain could be executed with publicly available tools within minutes of the vulnerabilities becoming known.
Hafnium and the Pre-Patch Exploitation
Microsoft's patches were released on March 2, 2021, but Hafnium had been exploiting ProxyLogon since at least January 6, 2021 - nearly two months before patching. During this window, Hafnium conducted targeted espionage against infectious disease researchers, law firms, defense contractors, higher education institutions, and NGOs focused on policy issues related to China.
The Hafnium operations were targeted and disciplined - characteristic of state-sponsored espionage. The attackers installed web shells, exfiltrated email, and maintained access. They were not attempting mass exploitation; they were conducting intelligence collection against specific targets of interest to Chinese foreign intelligence.
Microsoft became aware of the vulnerabilities through DEVCORE researcher Orange Tsai, who had reported them through the coordinated disclosure process. The challenge Microsoft faced was that Hafnium appeared to have independently discovered the same vulnerabilities - or had obtained information about them through other means - and was actively exploiting before a patch was ready. Microsoft accelerated the patch timeline when it became clear the vulnerabilities were being actively exploited.
Mass Exploitation and the Web Shell Wave
Within hours of the March 2 patch release, multiple threat actors had reverse-engineered the vulnerabilities from the patches and begun mass internet scanning. ESET observed at least ten different APT groups exploiting ProxyLogon within 24 hours of the patch. Ransomware operators, cryptominers, and criminal groups joined Chinese and other state-sponsored actors in mass exploitation.
The primary attack objective for most non-state actors was planting web shells for persistent access - small files hidden in Exchange's web directories that could accept commands via HTTP. These web shells would persist after patching (patching fixes the vulnerability but does not remove web shells already planted). Organizations that patched promptly but did not check for and remove existing web shells remained compromised.
CISA issued Emergency Directive 21-02 ordering all federal civilian agencies to immediately patch Exchange or take it offline - the highest urgency designation CISA issues. The scale of the problem was severe enough that CISA took the unprecedented step of publishing a tool to automatically remove web shells from compromised Exchange servers, developed in coordination with the NSA and Microsoft.
The Attribution Controversy
In July 2021, the Biden administration, NATO, the EU, and allied governments formally attributed the ProxyLogon exploitation to actors affiliated with China's Ministry of State Security (MSS). The attribution included a specific accusation that MSS contractors had conducted ransomware and criminal cyber operations for personal profit - an unusual element suggesting China tolerated or directed MSS-affiliated actors conducting criminal operations alongside state espionage.
The attribution was followed by DOJ indictments of four MSS officers for the Exchange exploitation and related operations. China denied involvement. The pattern - public attribution, indictments of untouchable individuals, no meaningful consequence - continued the established template for US responses to Chinese state cyber operations.