HAFNIUM__2021__HAFNIUM_targeting_Exchange_Servers_with_0-day_exploits_-_Microsoft_Security.pdf

Microsoft reports that the HAFNIUM group exploited multiple zero-day vulnerabilities in on-premises Exchange Server to gain unauthorized access, deploy web shells, dump LSASS memory, export mailbox data, and exfiltrate information; the advisory lists exploited CVEs, example web shell and post-exploitation commands, observable IOCs (file hashes, paths, filenames), and detection/hunting queries and mitigations, urging immediate patching and investigation.