Hafnium Zero-day Exploit: Threat Advisory Report

## Executive Summary In March 2021 Microsoft disclosed multiple critical zero-day vulnerabilities affecting on-premises Exchange Server that were actively exploited by a state-sponsored group dubbed HAFNIUM; the exploited issues (SSRF, deserialization, arbitrary file write) carried CVSS base scores of 7.8 or higher. ReliaQuest is tracking and ingesting IoCs into its GreyMatter platform, building detections and retroactive hunts to protect customers.