ProxyLogon (Microsoft Exchange, 2021)
The mass exploitation in early 2021 of four zero-day flaws in Microsoft Exchange mail servers, first by a Chinese state-linked group and then by many criminals, officially attributed to China in July 2021.
The flaws allowed an attacker to take control of an on-premises Exchange server without credentials, then plant a backdoor on it. A Chinese state-linked group was quietly exploiting them against chosen targets; in the days before and after the patch, exploitation became indiscriminate, and other groups, including ransomware operators, joined in. The case illustrates the shift from a targeted espionage operation to an accumulation event affecting tens of thousands of organizations. It poses a hard question for war and state operation exclusions: the origin is a state, but much of the damage is caused by criminals who reused the flaw.
Microsoft released its patches on March 2, 2021 and attributed the initial campaign to the group it calls Hafnium. At least 30,000 US organizations were compromised according to early estimates. On April 13, 2021, the FBI obtained court authorization to remotely remove backdoors from hundreds of servers, and on July 19, 2021 the United States, the European Union, the United Kingdom and NATO attributed the operation to China's Ministry of State Security.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.