Rapid Response: Mass Exploitation of On-Prem Exchange Servers

Huntress details widespread, active exploitation of on-premises Microsoft Exchange Server zero-day vulnerabilities (March–April 2021), reporting thousands of vulnerable servers and hundreds of observed webshells (China Chopper). The report documents exploitation chains and multi-stage PowerShell payloads that establish persistence, fetch additional payloads, and deploy post-exploitation tools (including Mimikatz and Cobalt Strike), provides IOCs and patch/verification guidance, and urges immediate patching and active hunting.