Attackers targeting four critical Microsoft Exchange Server zero-days patched this week hit a range of organizations across retail, government, and higher education, report the Mandiant researchers who today published their observations of the exploit activity.
Microsoft, which issued fixes for the vulnerabilities on March 2, says they have been used in “limited and targeted” attacks against law firms, infectious disease researchers, defense contractors, policy think tanks, and other victims. It attributes the exploits with high confidence to a group it calls Hafnium, which it believes is state-sponsored and operates out of China.
Mandiant began to see instances of abuse of Microsoft Exchange Server in at least one client environment starting in January, researchers write in their report. Their observations included creation of Web shells for…