Hello All. I wanted to pass on these pretty good technical details on the vulnerabilities affecting Microsoft Exchange on-premise:

After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server. Web shells potentially allow attackers to steal data and perform additional malicious actions that lead to further compromise. One example of a web shell deployed by HAFNIUM, written in ASP, is below:

Following web shell deployment, HAFNIUM operators performed the following post-exploitation activity:

• Using Procdump to dump the LSASS process memory:

• Using 7-Zip to compress stolen data into ZIP files for exfiltration:

• Adding and using Exchange PowerShell snap-ins to export mailbox data:

• Using the Nishang Invoke-PowerShellTcpOneLine reverse shell:

• Downloading PowerCat from GitHub, then using it to open a connection to a remote server:

HAFNIUM operators were also able to download the Exchange offline address book from compromised systems, which contains information about an organization and its users.

Our blog, Defending Exchange servers under attack, offers advice for improving defenses against Exchange server compromise. Customers can also find additional guidance about web shell attacks in our blog Web shell attacks continue to rise.