Hackers exploit unpatched Microsoft Exchange Server flaw

A critical security defect in on-premises Microsoft Exchange Server is now being weaponised by attackers who are chaining it with known techniques to install web shells and harvest credentials. The intrusion pattern mirrors tactics first popularised by the Hafnium-linked operations of 2021, where four zero-day bugs enabled the bulk compromise of Exchange servers running Outlook on the web. Unlike those older bugs, this flaw is not yet covered by a public patch, which sharply raises the urgency for any organisation still self-hosting mail.

Australia's exposure is far from theoretical. The Australian Cyber Security Centre has separately recorded multiple intrusions affecting healthcare providers, energy operators and local councils running hybrid Exchange environments, and the broader trend underlines why patched and unpatched servers sit at the heart of national resilience.

Anatomy of the server-side bug

The vulnerability under active abuse sits inside the way Exchange handles server-side request processing when rendering certain Outlook on the web payloads. By sending a crafted request, an unauthenticated remote actor can trick the front-end service into proxying internal requests, eventually reaching the backend that performs token validation. With token validation bypassed, the attacker lands in a position where normal authorisation checks no longer apply, opening the door to administrative-level operations.

Once that foothold exists, the attacker triggers a back-end cmdlet to drop an arbitrary file into a writable directory within the Exchange install path. From there, a compact web shell is enough to maintain persistent remote access even if the original vulnerability is later closed. Researchers have likened the chain to the ProxyLogon family of disclosures, where the initial bug is the door and the file-write flaw is the cupboard under the stairs.

For defenders, the practical concern is that the gap between proof-of-concept and in-the-wild exploitation has been measured in days rather than months. Public write-ups and tooling shared on GitHub speed up the timeline considerably, and any Exchange server reachable from the internet has effectively been considered exposed from the moment the technical details became widely available. The incident response community is already seeing early indicators of targeted lateral movement, with attackers pivoting from Exchange to domain controllers within hours of initial access, and several intrusions have used the foothold to rewrite Active Directory object permissions to maintain persistence.

Threat actors exploiting the flaw

Telemetry clusters the abuse around a small number of overlapping groups, including a cluster tracked variously as Silk Typhoon and Storm-0217. Both names have appeared in previous Exchange-focused operations, and the tooling deployed here shares fingerprints with earlier Hafnium-style kits, including the use of the China Chopper web shell and a custom credential-harvesting component branded internally by researchers as Sombra. Alongside these state-aligned clusters, ransomware affiliates have begun opportunistically scanning Exchange ranges, banking on the idea that organisations will take longer to patch than attackers will take to weaponise.

Australian defenders know this pattern well. Reports coordinated by the Australian Signals Directorate have repeatedly named China and Russia-aligned actors as the most persistent threats to networks in Sydney, Melbourne and Brisbane, particularly those tied to the defence industry, research institutions and federal supply chains. Financial criminals operating out of eastern Europe and West Africa have been observed piggy-backing on the same footholds, layering extortion demands on top of a data theft that the original attackers may not even realise has happened. Some of these clusters have also been observed trading access to compromised Exchange servers on criminal forums, where the value of a mailbox archive belonging to a chief financial officer can run into six figures in cryptocurrency.

Local exposure and sector impact

Within Australia, hybrid Exchange environments remain surprisingly common in mid-sized enterprises, regional health networks and local councils. Hospitals operating on legacy mail stacks, mining companies running distributed sites in Western Australia and Queensland, and universities supported by AARNet all fit the profile that adversaries target most aggressively. Even a small breach at one of these organisations can ripple outwards through shared services, clinical referrals or research partnerships. Smaller businesses that outsource IT to external managed service providers are no less exposed; in many cases the provider's remote management tooling is the very path attackers use to reach the customer's mail server.

The regulatory stakes are also meaningful. Under the Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner, an organisation that holds personal information and suspects unauthorised access must complete an assessment within thirty days and, where serious harm is likely, notify affected individuals. An Exchange compromise that exposes mailbox content, calendar entries and contact lists easily crosses that threshold, especially in clinical settings where patient records are stored alongside email.

The Essential Eight maturity model published by the Australian Cyber Security Centre has long warned that email servers are high-value crown jewels, and the new campaign should be read as a fresh reminder. Maturity Level Two on application control and patching is sometimes interpreted loosely by organisations that exclude Exchange from automated patching cycles because downtime is inconvenient, but that exception is precisely the gap attackers count on.

Signs of compromise worth hunting for

For blue teams, the fastest signal is usually a web shell left behind in one of a handful of predictable folders inside the Exchange Front End and Back End paths. Files such as red.aspx, error.aspx and shadow.aspx appearing under \Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth have appeared across multiple investigations, and any unexpected additions to those directories should be treated as a confirmed intrusion rather than a benign change.

Beyond file system artefacts, analysts should look for Exchange worker processes spawning unexpected children, particularly cmd.exe, powershell.exe or bitsadmin.exe. Outbound network connections from the Exchange server to IP ranges associated with VPS providers in Hong Kong, Frankfurt and Bucharest have shown up consistently in published reports, and DNS resolutions to non-standard top-level domains outside the organisation's mail flow are another quick win. Mailbox audit logs that show Inbox rules with unusual names, auto-forwarding to external addresses without prior history, or administrative audit entries created by service accounts that never log in interactively should all be treated as high-severity signals.

Security teams operating XDR or SIEM platforms should pull the public IOCs and translate them into hunting queries tailored to their own telemetry. Even a partial match is enough to justify rotating every credential with access to Exchange, including service accounts, OAuth applications and any federated identity provider configured to trust the organisation's AD forest.

Containment, patching and recovery steps

Microsoft has released emergency mitigation guidance while a full patch is prepared, including URL rewrite rules that block the specific crafted request pattern at the IIS layer and the ability to disable the Outlook on the web front-end on critical servers. These steps are stopgaps, not fixes, and should be paired with a planned patching window as soon as the official security update ships. Where possible, organisations should validate the integrity of the Exchange install path against a known-good baseline, because post-exploitation cleanup frequently involves subtle changes to legitimate files.

Recovery work typically begins with the complete reset of every privileged account that ever logged into Exchange, including domain admins, Exchange Organisation Administrators and any application identities. Rebuilding the affected server from a clean image is safer than attempting surgical cleanup, as web shells have often been observed in multiple variants and nested several directories deep. Logs from at least ninety days prior to the suspected intrusion should be preserved before any forensic question is answered, especially IIS logs, PowerShell script block logs and Windows security event logs. Backups taken before the suspected compromise date should be quarantined and scanned offline, because otherwise an attacker who had sufficient time inside the environment could have planted a trojanised backup image.

Regulators expect a clear paper trail. Boards in Sydney and Melbourne that fall under APRA's CPS 234 information security standard will need to demonstrate that the incident response was timely, that material exposures were escalated and that remediation was tracked to completion. The same standards apply to universities and research institutes that rely on Commonwealth funding, many of which fall within the scope of the Security of Critical Infrastructure reforms.

Hardening Exchange against the next wave

The broader lesson is that on-premises Exchange will keep attracting this kind of attention, and any organisation that treats patching as optional is borrowing trouble. A migration to Exchange Online removes the immediate problem, but it is not always possible for organisations constrained by data sovereignty rules, clinical systems or sovereign cloud requirements. For those still running the on-prem product, virtual patching at the reverse proxy, strict network segmentation between Exchange and the rest of the corporate environment, and continuous configuration monitoring are the only realistic ways to shrink the window of exposure between disclosure and weaponisation.

Coverage of the active exploitation and additional indicators of compromise is being tracked on SecNews24 alongside the broader pattern of email-server attacks over recent months. Defence teams in regional hubs such as Perth and Adelaide, where mature managed security providers are slightly thinner on the ground than in Sydney, are sharing response plans with peers and government partners as the next disclosure of this kind tends to be a matter of weeks, not months. Quarterly red team exercises built around simulated Exchange compromise scenarios have become a routine part of how those teams rehearse the credential reset and forensic triage that the latest campaign stresses.