If you manage on-premises Exchange Server, review two things separately: whether the server was exposed to the March 2021 vulnerabilities, and whether an attacker had already gained access. Apply the security updates appropriate to your Exchange version and servicing level, but do not treat a successful update as proof that the server is clean. Microsoft’s March 16, 2021 responder guidance put it plainly: “Applying the March 2021 Exchange Server Security Updates is critical to prevent (re)infection, but it will not evict an adversary who has already compromised your server.”
What the HAFNIUM attacks targeted
In March 2021, Microsoft reported zero-day exploitation of on-premises Exchange Server and attributed the campaign it initially observed, with high confidence, to HAFNIUM, which Microsoft assessed as a state-sponsored group operating from China. The four vulnerabilities named were CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. Microsoft later reported that other actors also began exploiting them after disclosure, so the activity should not be attributed to HAFNIUM alone.
Microsoft’s 2021 resource center said the vulnerabilities affected Exchange Server 2013, 2016, and 2019; it described the Exchange Server 2010 update as defense-in-depth. It said Exchange Online was not affected by these March 2021 vulnerabilities. Organizations with a hybrid deployment still needed to update their on-premises Exchange server, including one retained for management.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesMicrosoft reported RiskIQ telemetry of nearly 400,000 Exchange servers in the “total universe” on March 1, 2021. That was a historical count, not a count of vulnerable or compromised servers and not an estimate of current exposure.
Which settings and systems should you review first?
Confirm the Exchange deployment and update status
Identify every on-premises Exchange server, its version, and its servicing level, including servers that remain in a hybrid organization for management. Prioritize externally facing servers when assessing exposure. Microsoft’s March 2021 update instructions were specific to Exchange builds and cumulative updates; they are historical instructions, not a current build checklist.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Install the security update that Microsoft currently specifies for the server’s supported version and servicing state. Verify current support, servicing, and update requirements before making a change. Do not use the 2021 build requirements as present-day guidance.
Reduce exposure while a required update is pending
If an update cannot be applied immediately, consider whether access from untrusted networks can be blocked or the server temporarily isolated while work proceeds. Restricting access may reduce exposure, but Microsoft characterized such measures as partial protection and noted that they can affect functionality. Treat them as temporary risk reduction, not a replacement for the required update.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Review the four historical interim mitigations
For Exchange Server 2013, 2016, and 2019, Microsoft’s March 2021 mitigation guidance described the following measures for use when updates could not be applied promptly:
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
- IIS Rewrite rule: filter malicious HTTPS requests associated with the exploitation.
- Disable Unified Messaging (UM): this can interrupt UM functionality.
- Disable the Exchange Control Panel (ECP) virtual directory: this can remove ECP access.
- Disable the Offline Address Book (OAB) virtual directory: this can affect access to the offline address book.
Microsoft warned that these mitigations could affect Exchange functionality and were not guaranteed to cover every possible exploitation path. They were temporary bridges to updating, not durable security settings. Check the applicable Microsoft instructions and operational impact before changing a production server.
How do security updates, mitigations, and investigation differ?
These actions solve different problems. Updates address the vulnerable software; temporary mitigations reduce some exposure when an update is delayed; incident investigation looks for evidence that access was already obtained. Microsoft recommended updating and investigating in parallel rather than waiting for one workstream to finish before beginning the other.
| Action | What it addresses | Coverage and trade-off |
|---|---|---|
| Apply the appropriate security update | The known vulnerability in the server software | Microsoft described the updates as the complete mitigation for the March 2021 vulnerabilities. A patch does not, by itself, remove an attacker who already gained access. |
| Use a named interim mitigation | Some exploitation paths while the update is pending | Partial protection; may affect Exchange functionality; Microsoft did not guarantee coverage of every possible exploitation. |
| Restrict untrusted access or isolate the server temporarily | Exposure to further access while response work proceeds | Can reduce exposure but may disrupt service and is not a substitute for updating or checking for compromise. |
| Investigate logs, files, and the wider environment | Prior exploitation, persistence, and follow-on activity | Necessary even after updating when exposure or compromise is possible; it does not replace patching. |
How can you check whether an on-premises server was compromised?
Use Microsoft’s responder guidance to structure an investigation. A server can be patched and still have attacker-created files, persistence, or evidence of activity that needs to be addressed.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
- Preserve evidence. Retain relevant logs and record details such as timestamps and source IP addresses before routine cleanup or changes erase useful context.
- Review Exchange product logs. Look for suspicious activity and use the timing and source information to guide further analysis.
- Scan for known web shells. Treat a finding as evidence requiring investigation, not as an isolated file-cleanup task.
- Follow suspicious file access. Use relevant file activity to broaden the investigation beyond the initial server and determine whether other systems or accounts were affected.
- Check for lateral movement and further compromise. When evidence is found, investigate the surrounding environment for additional access, malware, or other post-exploitation activity.
A clean result from one scan or one log source is not, by itself, a comprehensive finding that no compromise occurred. Correlate available evidence and investigate suspicious indicators in context.
What were Microsoft’s 2021 mitigation tools designed to do?
Microsoft described the Exchange On-premises Mitigation Tool (EOMT) as a temporary mitigation tool that checked and mitigated CVE-2021-26855 and attempted to discover and remediate malicious files. The standalone ExchangeMitigations.ps1 applied mitigations but did not perform the same additional scanning. These are descriptions of historical tools and their 2021 purpose; verify current availability, instructions, and behavior before using any tool.
When should you escalate the response?
Consider engaging cybersecurity incident-response professionals if evidence suggests advanced post-exploitation, such as credential dumps, lateral movement, or additional malware or ransomware. Such findings can indicate that the incident extends beyond the Exchange server and requires broader containment and investigation.
Quick Recap
What should administrators take from the incident today?
- The 2021 campaign concerned on-premises Exchange Server; Microsoft said Exchange Online was not affected by those vulnerabilities.
- Updates and compromise investigation are separate workstreams. Completing one does not prove the other is complete.
- The named IIS, UM, ECP, and OAB measures were temporary mitigations with functional trade-offs, not substitutes for security updates.
- Verify current Microsoft support and servicing guidance for the version you operate; the 2021 update and tool instructions are not a current maintenance plan.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
