The Microsoft Exchange Server Exploit: What Happened Next

This report examines the widespread, active exploitation of four Microsoft Exchange Server zero-day vulnerabilities (ProxyLogon) by a range of actors — initially attributed to the HAFNIUM APT and later adopted by multiple APTs, ransomware operators (DearCry, Black Kingdom), and cryptomining botnets (LemonDuck) — describes PoC disclosures and potential leaks, outlines mitigation actions (patches, Microsoft mitigation tool, detection scripts), and maps observed behaviors to MITRE ATT&CK techniques while urging investigation of potentially compromised systems.