On 2 March 2021, Microsoft disclosed that a Chinese state-backed group it called HAFNIUM had been exploiting four zero-day vulnerabilities in on-premises Exchange Server — systematically, at tens of thousands of organisations, before any patch existed. Exchange Online was never affected; every self-hosted Exchange box in the world was. What followed was the largest incident-response surge in history to that point, and the year’s defining lesson in mass-exploitation aftermath.
HAFNIUM chained four zero-days (CVE-2021-26855 SSRF, CVE-2021-26857 unsafe deserialization, CVE-2021-26858/CVE-2021-27065 file-write) to achieve unauthenticated remote code execution on internet-facing Microsoft Exchange servers. Roughly 30,000–150,000 organisations worldwide were compromised in the pre-patch window — the famous “PATCH NOW” CISA directive of 2 March 2021 and emergency out-of-band fixes. Web shells (notably the China Chopper-family) persisted access long after patching, so the incident taught two lessons at once: mass exploitation happens between disclosure and patch, and patching does not equal remediation — you must evict.
What happened
Microsoft’s 2 March 2021 blog named HAFNIUM as a state-sponsored actor operating from China, exploiting a four-bug Exchange chain against on-premises servers — typically in the US, but globally in practice. The company released out-of-band patches the same day, and CISA’s directive order 21-02 told federal agencies to patch immediately, amid reporting of active mass exploitation by multiple actors beyond the original group. Because Exchange sat internet-facing in tens of thousands of mid-size organisations — schools, local government, hospitals, SMBs — the pre-patch window (estimated exploitation from early January, some evidence of earlier probing) produced the largest compromise footprint of any incident until then: estimates converged on 30,000+ US organisations and up to ~150,000 worldwide via follow-on scanner waves.
The four vulnerabilities worked as a kit, but the essential pair was CVE-2021-26855 (server-side request forgery letting an unauthenticated attacker impersonate an Exchange user to the backend) plus CVE-2021-27065/26858 (post-auth arbitrary file writes) — yielding web-shell deployment and full server control. After Microsoft’s disclosure, at least ten additional actors piled in scanning for unpatched servers like a gold rush, deploying their own shells and malware families (including ransomware crews later in March). The long tail defined the year: through spring and summer, incident responders were still evicting shells from networks patched in March but never checked for persistence.
Attribution and geopolitics followed familiar lines — Microsoft assessed HAFNIUM as China-based state-sponsored; the US and allied governments formally attributed exploitation to the Chinese Ministry of State Security in July 2021, alongside the wider Hafnium-linked campaign set (including the Papercut-style intrusions and the later ProxyLogon attribution debates). For defenders, the name mattered less than the maths: internet-facing Exchange = pre-owned until proven otherwise, throughout 2021.
How it worked
The chain’s elegance was using Exchange’s own trusted plumbing against it. The SSRF front-door bug let attackers reach backend endpoints as an authenticated user without ever presenting credentials; the backend file-write bugs then allowed writing to paths served by the web root — a web shell.
internet -> Exchange OWA/ECP (443)
(1) CVE-2021-26855 SSRF: spoofed-backend request, no creds needed
(2) autodiscover probing -> internal info (emails, mailbox paths)
(3) CVE-2021-26857 deserialization OR 26858/27065 file write
-> write ASPX web shell to web-accessible path
(4) shell = persistent unauthenticated RCE
(5) mailbox exfiltration + laterally via Exchange as trusted tier asset
post-patch: shells REMAIN -> eviction phase beginsTwo lessons live forever in this chain. First, “authenticate everything” failed at the boundary: the SSRF bypassed authentication because the backend trusted requests relayed by the frontend — a trust-configuration lesson applicable to every split-tier architecture. Second, web shells turned a one-day emergency into a year of incident response: cheap to drop, trivially polymorphic, and invisible to patch-based remediation. The response industry’s standard Exchange-forensics kits (scanning for specific shell families, mailbox export review, re-do of delegation) were forged in this fire, and the eviction-checklist approach carried into later edge-device crises (Ivanti, Citrix, Fortinet).
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Zero-days in the chain | 4 (CVE-2021-26855, -26857, -26858, -27065) | Microsoft MSRC blog |
| Patch release / CISA directive | 2021-03-02/03 | Microsoft + CISA ED 21-02 |
| Organisations compromised (estimates) | 30,000 US (est.); up to ~150,000 globally in scanned follow-on | federal officials to press; Emsisoft/Kaspersky estimates |
| Post-disclosure actor count | 10+ scanning/exploiting groups within weeks | Microsoft IR/fortinet telemetry |
| Web shell families observed | China Chopper variants plus novel one-actor shells | IR vendor reports |
| Formal attribution | China MSS-affiliated, July 2021 (US + allies statement) | White House/interagency |
Timeline
| Date | Event |
|---|---|
| 2021-01 (early) | First targeted exploitation observed (later forensics) |
| 2021-03-02 | Microsoft discloses HAFNIUM + four zero-days; out-of-band patches |
| 2021-03-03 | CISA emergency directive; global scramble; mass-scanner phase begins |
| 2021-03 (mid) | Copycat actors + first ransomware follow-ons reported |
| 2021-07-19 | US + allies formally attribute to China MSS |
| 2021 (year) | Long-tail web-shell eviction continues industry-wide |
Why it still matters in 2026
HAFNIUM set the tempo for every mass edge-device exploitation since: disclosure → patch race → scanner gold rush → long-tail evictions. The playbook it forced — emergency patch SLAs for internet-facing infrastructure, mandatory web-shell hunts post-patch, and treating persistence separately from vulnerability — is now standard incident doctrine, reused for ProxyShell/ProxyNotShell, Ivanti, Citrix Bleed and beyond. The trust-boundary lesson (backend trusting frontend-relayed identity) generalises to modern API gateways and service meshes, which is why this 2021 case still anchors training on zero-day surge response. And for architecture roadmaps, it remains the cleanest argument for getting exchange-style services off the internet front line entirely.
Detection and hardening takeaways
- Patch internet-facing collaboration servers same-day. Exchange-style crown-jewel internet exposure dominated 2015–2023 losses; every day counts in the disclosure-to-patch window — and pre-patch exploitation means the window predates your awareness.
- Hunt web shells after every edge-device emergency. Patching closes the door, not the house: run dedicated shell hunts (known families + anomaly scanning of web roots) before declaring remediation complete.
- Monitor mailbox export activity. Post-exploitation exfil frequently used Exchange’s own export/.search functions; unusual eDiscovery-style queries from service contexts are high-signal.
- Segment and de-tier mail infrastructure. Mail servers hold everyone’s data and often legacy trust; treat as tier-0-adjacent, not “just another app server.”
- Rehearse CISA-directive-speed ops. Have a pre-authorized emergency-change process so “patch all Exchange tonight” is an execution task, not a committee one.
FAQ
Was Exchange Online (Microsoft 365) affected?
No. The vulnerabilities were in on-premises Exchange Server. Every organisation running its own Exchange with OWA/ECP reachable from the internet was in scope; hosted/cloud tenants were not. This distinction drove the divergence: enterprises on M365 read the news, while 100,000+ smaller self-hosted environments live through it.
How is HAFNIUM different from ProxyLogon/ProxyShell?
They are cousins. The March 2021 zero-day set (ProxyLogon name applies to the same SSRF family) was exploited pre-patch by HAFNIUM; ProxyShell (disclosed April–July 2021, chained by many actors) reused related bugs from the same codebase. Confusion arises because reporting used both names for overlapping bug sets; HAFNIUM specifically denotes the actor, ProxyLogon/ProxyShell the vulnerability families.
My organisation patched in March 2021. Were we safe?
Possibly not — that was the year’s hard lesson. If exploitation preceded patching, web shells persisted through the update. Complete remediation required forensic checks for shells and persistence, credential resets for mail-tier accounts, and review of mailbox access. Many “patched” networks discovered shells months later; formal eviction guidance existed precisely for that gap.
