Microsoft counters Chinese attackers with patch for major Exchange Server flaw
All Exchange Server customers should apply the latest security updates.
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
What you need to know
Microsoft recentlyrolled out security updatesto fix four vulnerabilities in Exchange Server software (viaEngadget). The vulnerabilities were utilized in cyberattacks orchestrated by a group Microsoft calls Hafnium. As explained by a Microsoft blog post, Hafnium operates out of China and is “a highly skilled and sophisticated actor.”
Microsoft refers to Hafnium as a state-sponsored threat actor that operates out of China, but that primarily conducts its operations from leased virtual private services in the United States.
According to Microsoft, the primary targets of Hafnium include infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.
Microsoft outlines the three steps of the recent attacks:
First, it would gain access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise itself as someone who should have access. Second, it would create what’s called a web shell to control the compromised server remotely. Third, it would use that remote access – run from the U.S.-based private servers – to steal data from an organization’s network.
Microsoft released security updates that will protect people running Exchange Server. Microsoft says that all Exchange Server customers should apply the updates immediately.
The company also briefed U.S. government agencies on the attacks.
Microsoft concludes the blog post by specifying that these attacks are not connected in any way to the SolarWinds attacks that have been in the headlines.
Get the Windows Central Newsletter
All the latest news, reviews, and guides for Windows and Xbox diehards.
Microsoft hasanother postthat breaks down the attacks in more technical detail.
Sean Endicott is a tech journalist at Windows Central, specializing in Windows, Microsoft software, AI, and PCs. He’s covered major launches, from Windows 10 and 11 to the rise of AI tools like ChatGPT. Sean’s journey began with the Lumia 740, leading to strong ties with app developers. Outside writing, he coaches American football, utilizing Microsoft services to manage his team. He studied broadcast journalism at Nottingham Trent University and is active on X @SeanEndicott_ and Threads @sean_endicott_.
