Telemetry analysis published by Imperva following the March 2, 2021 disclosure of four zero-day vulnerabilities in Microsoft Exchange Server — attributed to the Chinese state-sponsored group HAFNIUM — documented over 44,000 scanning and exploitation attempt sessions from more than 1,600 unique source IPs within weeks of the public disclosure. The campaign's near-universal industry targeting reflects Exchange's ubiquity across all sectors, and the rapid shift of exploitation activity beyond the original HAFNIUM cluster underscores how quickly nation-state zero-days become commoditized once publicly disclosed.
The ProxyLogon Attack Chain
The most critical vulnerability in the chain, CVE-2021-26855, is a server-side request forgery (SSRF) flaw in Microsoft Exchange that allows an unauthenticated attacker to induce the server into performing unintended actions via specially crafted POST requests. By manipulating the X-BEResource and X-AnonResource-Backend cookie values in requests to the Exchange Admin Centre (/ecp/) or Outlook Web Application (/owa/), an attacker can proxy malicious requests to Exchange backend components. CVE-2021-26855 serves as the entry point enabling chained exploitation of three additional vulnerabilities — CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 — that together enable remote code execution and arbitrary file writes on the Exchange server.
Three Most Common Exploitation Patterns
Imperva analysts categorized observed exploitation attempts by target endpoint, revealing distinct attacker objectives:
- /autodiscover/autodiscover.xml (51% of attempts): The most common pattern — SSRF requests to the ECP endpoint with the cookie targeting the Autodiscover service. Autodiscover exposes Exchange configurations, service URLs, and supported protocols, making it the primary reconnaissance target for attackers mapping the environment and gathering data required for chained CVE exploitation.
- /EWS/Exchange.asmx (18% of attempts): POST requests to ECP and OWA endpoints with the cookie set to the Exchange Web Services endpoint, enabling authenticated access to private email on the server — consistent with intelligence collection objectives.
- /mapi/emsmdb (3% of attempts): Crafted requests to this MAPI endpoint to procure a valid SID, enabling privilege escalation to the Exchange
proxyLogin.ecpendpoint, and subsequently obtaining validASP.NET_SessionIDandmsExchEcpCanaryvalues required for further chained exploitation.
Targeting Profile and Attacker Origins
Computing and IT organizations were the most targeted sector at 21% of all targeted sites, followed by Financial Services at 18% and Telecoms/ISPs at 10.5% — a distribution that broadly mirrors Exchange's deployment across enterprise sectors. The United States was the most targeted country, with the UK and Singapore a distant second and third. Of the 1,600+ attacking IP addresses, 42.3% carried prior Imperva tags for malicious behavior and 8.45% were previously identified as vulnerability scanners, indicating a mix of targeted exploitation and opportunistic mass scanning. Relatively few attempts originated from Chinese source IPs — consistent either with attackers using proxy infrastructure to obscure origin, or with exploitation having dispersed widely beyond the original HAFNIUM cluster to a broad range of opportunistic threat actors following public disclosure.