Microsoft Says China-Linked Hackers Hit Its Exchange Email Servers

While the group operates out of China, it's using servers located in the U.S. to launch its attacks. Microsoft stated Hafnium used the four newly discovered, and patched, security vulnerabilities to slip into Exchange email servers. When used together, the four vulnerabilities created an attack chain that enabled attackers to steal data such as email accounts and address books from a victim’s organization and granted the ability to plant malware. The on-premise servers running Exchange 2013 and later were affected.

Microsoft stated that Hafnium was the primate threat group it caught using these four vulnerabilities, and while Microsoft didn't elaborate on the number of successful attacks it had seen, the number was reportedly "limited," Tech Crunch reported.

The company quickly deployed an update for the Hafnium exploits, but stated that "we know that many nation-state actors and criminal groups will move quickly to take advantage of any unpatched systems. Promptly applying today’s patches is the best protection against this attack." Microsoft is now urging users to download the software patches.

The U.S. government agencies were made aware of the new findings. Microsoft also wrote, "We continue to see no evidence that the actor behind SolarWinds discovered or exploited any vulnerability in Microsoft products and services." Previously, the FBI had stated the SolarWinds was "likely Russian in origin," and news has started circulating that it may have begun with an intern's surprisingly easy password.