Article
NCSC Annual Review 2025: UK Cyber Threat Findings
NCSC Annual Review 2025 key findings: 429 incidents handled, 204 nationally significant, plus state threats, ransomware and AI, for UK organisations.
Read more
Significant cyber incident
Microsoft Exchange ProxyLogon mass exploitation, 2021
The Microsoft Exchange ProxyLogon attacks of early 2021 used four previously unknown flaws in on-premises Exchange Server to reach email servers around the world.
In short
The Microsoft Exchange ProxyLogon attacks of early 2021 used four previously unknown flaws in on-premises Exchange Server to reach email servers around the world. Microsoft disclosed the attacks and released fixes on 2 March 2021, and use of the flaws spread fast once the fix was public. Sources put the number of victims at tens of thousands or more, and attackers left web shells for later access.
What happened
On 2 March 2021 Microsoft said it had seen several previously unknown flaws used against on-premises Exchange Server in limited and targeted attacks. It released fixes the same day for four flaws, led by CVE-2021-26855. The flaws did not affect Exchange Online.
The US Department of Justice later said certain groups used the flaws in January and February 2021, and that other groups followed from early March once the flaw and the patch were public. Microsoft said it saw wider use by many actors from 5 March.
The attackers placed web shells, small scripts that give remote access, on the servers. CISA reported that ransomware called DearCry was also used on compromised servers from 12 March. In April the FBI removed web shells from hundreds of US servers under a court order.
On 19 July 2021 the United States, the United Kingdom, NATO and others attributed the activity to China-linked actors. Microsoft had named the first actor HAFNIUM in March.
Timeline
-
January to February 2021
The US Department of Justice says certain hacking groups used the Exchange zero-day flaws in these months
-
2 March 2021
Microsoft announces the attacks, names HAFNIUM and releases fixes for four flaws
-
3 March 2021
CISA issues Emergency Directive 21-02 and its first alert; NVD publishes the record for CVE-2021-26855
-
5 March 2021
Federal agency reports to CISA are due; Microsoft reports increased use by multiple actors beyond HAFNIUM
-
10 March 2021
CISA tells organizations to run Microsoft's Test-ProxyLogon.ps1 script and to look back to at least 1 January 2021
-
12 March 2021
CISA adds that DearCry ransomware is used on compromised on-premises Exchange servers
-
15 March 2021
Microsoft releases a one-click mitigation tool for customers without dedicated security or IT teams
-
End of March 2021
Per GOV.UK, Microsoft said 92% of customers had patched
-
12 April 2021
CISA identifies 10 web shells tied to the activity and adds a DearCry malware analysis report
-
13 April 2021
The Justice Department announces the FBI web shell removal; CISA issues Supplemental Direction v2
-
19 July 2021
The US, UK, NATO and others attribute the Exchange activity to China-linked actors
-
3 November 2021
CISA adds CVE-2021-26855 to its Known Exploited Vulnerabilities catalog
-
8 January 2026
CISA closes ED 21-02 and moves the actions to BOD 22-01
How the attack worked
Microsoft’s own description of the attack is the main source here. It says the actor chained four flaws in on-premises Exchange Server. This was a case of Exploit Public-Facing Application (T1190).
Getting in
CVE-2021-26855 is a server-side request forgery flaw. Microsoft said it let the attacker send arbitrary HTTP requests and authenticate as the Exchange server. CISA says an unauthenticated attacker could use it, and that this could give access to mailboxes.
Writing files and running code
CVE-2021-26858 and CVE-2021-27065 let an authenticated attacker write a file to any path on the server. CVE-2021-26857 is an insecure deserialization flaw in the Unified Messaging service that gave code execution as SYSTEM. The attacker could be authenticated by the first flaw or by stolen admin credentials.
Staying in
After the first access the operators deployed web shells. This is Server Software Component: Web Shell (T1505.003). CISA found 10 web shells tied to the activity, each analyzed as a China Chopper web shell, and said the list was not complete. CISA also said a web shell can be used to harvest data and credentials and to upload more malware.
Taking data and moving on
Microsoft listed follow-on steps by the HAFNIUM operators: dumping LSASS memory with Procdump (OS Credential Dumping, T1003.001), compressing stolen data with 7-Zip (Archive via Utility, T1560.001) and exporting mailbox data with Exchange PowerShell snap-ins. CISA added that, once authenticated, an attacker could reach the Active Directory database.
Other actors and ransomware
Microsoft said that from 5 March other actors also used the flaws against unpatched servers. On 12 March CISA said DearCry ransomware was being used on compromised on-premises Exchange servers. The US attribution of July 2021 covers the Exchange activity, not DearCry itself.
- Exploit the serverChained Exchange flaws, starting with a server-side request forgery in CVE-2021-26855Technique T1190 (MITRE ATT&CK, opens in a new tab)
- Write filesAuthenticated file write and code execution as SYSTEM
- Plant web shellsWeb shells left for later remote accessTechnique T1505.003 (MITRE ATT&CK, opens in a new tab)
- Take credentialsLSASS memory dumped with ProcdumpTechnique T1003.001 (MITRE ATT&CK, opens in a new tab)
- Collect dataStolen data compressed with 7-Zip for exfiltrationTechnique T1560.001 (MITRE ATT&CK, opens in a new tab)
- Follow-on useOther actors joined from 5 March; DearCry ransomware used on compromised servers
ATT&CK techniques
- Technique Archive Collected Data Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out. T1560 · Collection
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Server Software Component: Web Shell (T1505.003) A web shell is a small script that an attacker places on a web server. T1505.003 · Persistence
Who says who was behind it
- Ransomware group DearCry DearCry is ransomware that CISA said, in a March 12, 2021 update, was being used on compromised on-premises Exchange servers. Since March 2021 · Ransomware family deployed after Exchange server compromise
- Threat group HAFNIUM Attributed by the US and UK governments (19 July 2021) to the Chinese state, and charged by the US Department of Justice (8 July 2025) as directed by officers of China's Ministry of State Security, HAFNIUM is the name given to the campaign that exploited Microsoft Exchange Server flaws in early 2021. China · Since 2021
Who attributed it, and how firm it is
Attributed by Microsoft, 2 March 2021: Microsoft attributed the campaign with high confidence to HAFNIUM, a group it assessed to be state-sponsored and operating out of China.
Attributed by the UK, 19 July 2021: the NCSC said it was almost certain the compromise was started and used by a Chinese state-backed actor, and highly likely that HAFNIUM is associated with the Chinese state.
Attributed by the United States, 19 July 2021: the White House attributed the Exchange espionage, with a high degree of confidence, to actors affiliated with China's Ministry of State Security (MSS). CISA repeated this in its alert.
Acknowledged by NATO, 19 July 2021: NATO acknowledged national attributions by Canada, the United Kingdom and the United States. The NCSC annual review says the UK joined 38 partners, including the Five Eyes, NATO, the EU and Japan.
The first two statements name the vendor's label HAFNIUM; the White House text names the MSS and not a group name. Whether every actor that used the flaws after early March acted for a state is not stated; Microsoft said multiple actors beyond HAFNIUM used them.
Malware and vulnerabilities used
- Malware China Chopper China Chopper is a small web shell that attackers place on a web server to get remote access to it. Legitimate tool abused · Windows
- Vulnerability ProxyLogon Exchange flaw (CVE-2021-26855) CVE-2021-26855 is a flaw in on-premises Microsoft Exchange Server, the first link in the attack chain called ProxyLogon. CVE-2021-26855 · Microsoft · Server-side request forgery (SSRF)
Impact
Sources differ on scale. The White House said tens of thousands of computers and networks worldwide were compromised, with significant remediation costs for mostly private sector victims. The NCSC said open-source reporting indicates at least 30,000 organizations were compromised in the US alone. The GOV.UK release said the attacks affected over a quarter of a million servers worldwide, and that Microsoft reported 92% of customers had patched by the end of March.
The NCSC called it the most significant and widespread intrusion against the UK and allies uncovered to date, and said it gave tailored advice to over 70 affected UK organizations.
The UK assessed the attack was highly likely to enable large-scale espionage, including theft of personal data and intellectual property. The Department of Justice said hundreds of web shells were still in place on US servers at the end of March. No ransom totals are given in the sources opened.
Government and regulator response
- 2 March 2021, Microsoft: released fixes for the four flaws and published indicators and guidance. On 15 March it released a one-click mitigation tool for small teams.
- 3 March 2021, CISA: issued Emergency Directive 21-02. Federal agencies had to find all on-premises Exchange servers, check them for compromise and patch. Agencies with signs of compromise, or without the skills to check, had to disconnect the servers. Reports were due on 5 March. Supplemental directions followed on 31 March and 13 April.
- 10 March 2021, CISA: told organizations to run Microsoft’s Test-ProxyLogon.ps1 and to look back to at least 1 January 2021.
- 13 April 2021, Department of Justice and FBI: a court-authorized operation copied and removed web shells from hundreds of US servers. It did not patch the flaws or remove other malware, and the FBI said it would notify owners by email.
- April 2021, United States: the White House said the Government acted to stop compromised systems being used for ransomware, and used a Cyber Unified Coordination Group that included private companies.
- 19 July 2021, UK, US, NATO: public attribution to China-linked actors; the NCSC advised organizations to follow vendor advice and report suspected compromise.
- 3 November 2021 and 8 January 2026, CISA: CVE-2021-26855 added to the Known Exploited Vulnerabilities catalog; ED 21-02 closed and moved into BOD 22-01.
Lessons
-
Patching alone did not clear a compromise
The Department of Justice said its operation did not patch the flaws or remove other malware, and hundreds of web shells stayed in place after patches were out. A patch closes the door but does not remove an intruder who already got in.
-
Exposure window matters more than the patch date
The flaws were used in January and February 2021 before the 2 March fix. CISA told organizations to look back to at least 1 January 2021.
-
Public fixes start a race
The Department of Justice said other groups followed from early March after the flaw and patch were public, and Microsoft saw wider use from 5 March. Patch internet-facing servers within hours.
-
Assume deeper compromise
CISA said that if exploitation is found, organizations should assume network identity compromise, since an attacker could reach the Active Directory database.
-
Small teams need simple tools
Microsoft released a one-click tool for customers without dedicated security or IT teams. Plan how smaller IT teams will get help in a crisis.
-
Ransomware can follow espionage
CISA reported DearCry ransomware on compromised Exchange servers within days. Treat any web shell as a possible ransomware entry point.
What to check in your own organization
-
Find every on-premises Exchange server
List all servers, including old or forgotten ones. CISA's directive began with identifying all instances of on-premises Exchange.
-
Confirm patch level
Check that Exchange 2013, 2016 and 2019 servers carry the March 2021 and later security updates, and that servers are not exposed to the internet longer than needed.
-
Hunt for web shells
Look for unexpected .aspx files in the Exchange web folders and review server logs back to at least 1 January 2021, as CISA advised.
-
Run the Microsoft scripts
Run Test-ProxyLogon.ps1 and Microsoft's mitigation tool, and review results with your security team.
-
Review credentials
If any sign of exploitation is found, treat accounts as exposed, including Active Directory, and reset them under your incident plan.
-
Plan for disconnection
Decide in advance who may take a mail server offline and how mail continues. ED 21-02 told agencies with signs of compromise to disconnect servers.
-
Check for ransomware
Make sure offline backups exist and that detection covers ransomware on mail servers.
Where it happened
Questions
What is ProxyLogon?
The name used for the chain of Exchange flaws led by CVE-2021-26855. Microsoft fixed four related flaws on 2 March 2021: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Did it affect Microsoft 365?
No. Microsoft and CISA both said Exchange Online and Microsoft 365 were not affected. Only on-premises servers were.
Who was behind it?
Microsoft attributed it to HAFNIUM in March 2021. In July 2021 the US, UK, NATO and others attributed the Exchange activity to China-linked actors. The US named the Ministry of State Security.
What is HAFNIUM?
A name used by Microsoft for a group it assessed to be state-sponsored and operating out of China. Microsoft's page now tags it Silk Typhoon (HAFNIUM).
What did the FBI do?
Under a court order on 13 April 2021 the FBI sent a command through web shells on hundreds of US servers so the servers deleted only the web shell. It did not patch the servers.
Was ransomware used?
Yes. CISA updated its alert on 12 March 2021 to say DearCry ransomware was used on compromised on-premises Exchange servers. The attribution covers the Exchange activity, not DearCry.
Sources
- HAFNIUM targeting Exchange Servers with 0-day exploits (2 March 2021) Microsoft
- Mitigate Microsoft Exchange Server Vulnerabilities, AA21-062A CISA
- ED 21-02: Mitigate Microsoft Exchange On-Premises Product Vulnerabilities CISA
- Justice Department Announces Court-Authorized Effort to Disrupt Exploitation of Microsoft Exchange Server Vulnerabilities (13 April 2021, archived copy) US Department of Justice
- The United States, Joined by Allies and Partners, Attributes Malicious Cyber Activity and Irresponsible State Behavior to the People's Republic of China (19 July 2021) The White House
- UK and allies hold Chinese state responsible for pervasive pattern of hacking UK National Cyber Security Centre
- UK and allies hold Chinese state responsible for a pervasive pattern of hacking GOV.UK
- NCSC Annual Review 2021, Microsoft Exchange UK National Cyber Security Centre
- Statement by the North Atlantic Council on malicious cyber activities including the Microsoft Exchange Server compromise NATO
- CVE-2021-26855 record NIST National Vulnerability Database
- HAFNIUM, Group G0125 MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.