Exchange ProxyLogon: 250,000 Servers Backdoored in 24 Hours via Email Server Zero-Days
Four zero-day vulnerabilities in Microsoft Exchange Server were exploited by Chinese hackers before Microsoft could patch them, backdooring an estimated 250,000 Exchange servers — including US defence contractors and infectious disease researchers — within 24 hours of public disclosure.
Background
Microsoft Exchange Server is the most widely deployed email server software in enterprise environments worldwide. The ProxyLogon vulnerability chain (CVE-2021-26855, -26857, -26858, -27065) was discovered by Volexity and DEVCORE in January 2021 and reported to Microsoft. The Chinese group HAFNIUM was already exploiting it.
The Attack
ProxyLogon allowed an unauthenticated attacker to access Exchange servers by bypassing authentication via a server-side request forgery vulnerability (CVE-2021-26855), then use post-authentication vulnerabilities to write web shells (backdoors accessible via HTTP) to the server. The attack required no credentials. HAFNIUM had been exploiting the zero-days for months, targeting infectious disease researchers, law firms, defence contractors, and think tanks. When Microsoft released patches on March 2, 2021, other nation-state groups and criminal actors immediately weaponised the details, triggering mass exploitation. Approximately 250,000 Exchange servers were backdoored within 24 hours.
Response
Microsoft released patches on March 2, 2021, alongside public disclosure. CISA issued an emergency directive requiring all federal agencies to patch within four days. Microsoft released a one-click remediation tool. The FBI obtained a court order to remotely remove web shells from hundreds of infected US servers — an extraordinary legal precedent.
Outcome
Tens of thousands of organisations were still finding ProxyLogon web shells months later. The FBI's court-ordered remote remediation was controversial but legally unprecedented. The Chinese Ministry of State Security was officially blamed by the US, EU, and NATO — the broadest attribution of a Chinese cyber operation.
Key Takeaways
- Email servers must be patched within hours of critical vulnerability disclosure — they are always a top target
- Web shells left after exploitation create persistent access even after vulnerabilities are patched — scan for them
- Patch disclosure triggers immediate mass exploitation — assume you will be attacked the day a patch is released
- FBI remote remediation of private company servers set a significant legal precedent for government cyber response