HAFNIUM__2021__Microsoft_New_nation-state_cyberattacks_03-02-2021.pdf

Microsoft describes a nation-state threat actor named Hafnium that conducted targeted intrusions against U.S.-based organizations by exploiting previously unknown vulnerabilities in on-premises Exchange Server. The actor gained access via stolen credentials or zero-day vulnerabilities, deployed web shells for persistent remote control, and exfiltrated data; Microsoft released security updates and urged immediate patching while coordinating with government and security researchers.