{"id":1358,"date":"2021-03-03T20:55:00","date_gmt":"2021-03-03T20:55:00","guid":{"rendered":"https:\/\/www.pax8.com\/future-blog\/alert-hafnium\/"},"modified":"2023-05-17T00:59:41","modified_gmt":"2023-05-17T00:59:41","slug":"alert-hafnium","status":"publish","type":"post","link":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/","title":{"rendered":"Protect against HAFNIUM 0-Day Exploits"},"content":{"rendered":"<p><i>Last updated on Wednesday, March 10, 2021 at 4:30pm<\/i><i>\u00a0MT.<\/i><\/p>\n<p>Immediate actions to take to protect your clients and your business.<\/p>\n<p>On Tuesday, March 2, 2021, Microsoft announced that they\u00a0<a href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2021\/03\/02\/new-nation-state-cyberattacks\/\" target=\"_blank\" rel=\"noopener noreferrer\">identified new nation-state cyberattacks<\/a>, named\u00a0HAFNIUM,\u00a0using previously unknown exploits that target\u00a0vulnerabilities in\u00a0the company\u2019s on-premises Exchange Server software.<\/p>\n<p>In the attacks observed, the threat actor used these vulnerabilities to access on-premises Exchange servers, which enabled access to email accounts and allowed installation of additional malware to facilitate long-term access to victim environments.<\/p>\n<p>The vulnerabilities exist in on-premises Exchange Servers 2010, 2013, 2016, and 2019. Exchange Online is not affected, and Microsoft\u00a0has\u00a0no evidence that\u00a0HAFNIUM\u2019s\u00a0activities targeted individual consumers or that these exploits impact other Microsoft products.<\/p>\n<p><b>Microsoft highly recommends that you take immediate action to apply the patches for any on-premises Exchange deployments<\/b><b>\u00a0<\/b>you own\u00a0or are managing for a customer or advise your customer\u00a0to take\u00a0these steps.\u00a0Here&#8217;s what you need to know and do to protect your on-premises\u00a0Exchange servers from falling victim to a\u00a0HAFNIUM\u00a0attack.<\/p>\n<h2>How\u00a0The\u00a0HAFNIUM\u00a0Attacks\u00a0Work<\/h2>\n<p>While\u00a0based in China,\u00a0HAFNIUM\u00a0conducts its operations primarily from leased virtual private servers\u202f(VPS)\u202fin the United States.\u00a0The attacks\u00a0include three steps:<\/p>\n<p>1. It gains\u00a0access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise itself as someone who should have access.<\/p>\n<p>2. It creates\u00a0what\u2019s called a web shell to control the compromised server remotely.<\/p>\n<p>3. It uses\u00a0that remote access\u00a0\u2014\u00a0run from the US-based private servers\u00a0\u2014\u00a0to steal data from an organization\u2019s network.<\/p>\n<h2>Immediate\u00a0Actions\u00a0to Take<\/h2>\n<p>On March 3, 2021, Pax8 hosted a live Q&amp;A where we discussed the immediate actions you can take to defend against this urgent cyberattack \u2014 as well as how to protect your clients and your business from these types of cyberattacks in the future. Watch the full recorded session below.<\/p>\n<h3>New Consolidated Guidance from Microsoft<\/h3>\n<p>Microsoft has shared additional guidance and product updates to help you and your clients following last week\u2019s\u00a0<a href=\"https:\/\/nam06.safelinks.protection.outlook.com\/?url=https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fexchange-team-blog%2Freleased-march-2021-exchange-server-security-updates%2Fbc-p%2F2188142&amp;data=04%7C01%7CHiroki.Asami%40microsoft.com%7Ceb46840e3a164761159208d8e2c5128e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637508683798028917%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=TE04VU%2BXZXgIZztb762MqV%2BmGdfFs7kmvVtiu0PgxWU%3D&amp;reserved=0\">March 2021 Exchange Server\u00a0Security Updates<\/a>.\u00a0The below guidance consolidates information from multiple Microsoft blogs and communications to explain the situation and help clarify the steps required to respond:<\/p>\n<p><strong>\u2022<\/strong> An updated MSRC blog post <a href=\"https:\/\/nam06.safelinks.protection.outlook.com\/?url=https%3A%2F%2Fcomm.microsoft.com%2FPoliteMail245%2Fdefault.aspx%3Fpage%3DA6XGIxXPJUKX0zDepkXXpg%26ref_id%3D3JUg_xxB7kqyN3Ei6qGPbA&amp;data=04%7C01%7CHiroki.Asami%40microsoft.com%7Ceb46840e3a164761159208d8e2c5128e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637508683798038874%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=jkkbxXlec3fcNSmRlW1fpz8Al%2BFXecS8Fz6KmoTT3VE%3D&amp;reserved=0\">Multiple Security Updates Released for Exchange Server \u2013 updated March 8, 2021<\/a>\u00a0to provide a comprehensive overview of the security updates for Exchange Server and recommended steps to patch and remediate.<\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/nam06.safelinks.protection.outlook.com\/?url=https%3A%2F%2Fcomm.microsoft.com%2FPoliteMail245%2Fdefault.aspx%3Fpage%3DgEakKl7GFUukUnjxR9mrBw%26ref_id%3D3JUg_xxB7kqyN3Ei6qGPbA&amp;data=04%7C01%7CHiroki.Asami%40microsoft.com%7Ceb46840e3a164761159208d8e2c5128e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637508683798038874%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=uTD2pZ6VszkjimF1VyjRHYiSY6wb7h0EX9okWBRWuQg%3D&amp;reserved=0\">Step-by-step instructions on patching and remediation<\/a>, detailed by version of Exchange Server.<\/p>\n<p>Regardless of your long-term plans for Exchange on-premises, these steps should be taken\u00a0immediately\u00a0to secure on-premises deployments from these newly found zero-day threats:<\/p>\n<h3>Immediately Patch\u00a0Your Exchange Environments<\/h3>\n<p>A major zero-day incident is the exact scenario for which abnormal patching schedules exist. Just like Microsoft broke their normal patch release schedule, you must not wait for Patch Tuesday to deploy these patches.<\/p>\n<p>Exchange patch information:<\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/releaseNote\/2021-Mar\" target=\"_blank\" rel=\"noopener noreferrer\">March 2, 2021 Security Update Release &#8211; Release Notes &#8211; Security Update Guide &#8211; Microsoft<\/a><\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-26855\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2021-26855<\/a>\u00a0| Microsoft Exchange Server Remote Code Execution Vulnerability (public)<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"1\"><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-26857\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2021-26857<\/a>\u00a0| Microsoft Exchange Server Remote Code Execution Vulnerability (public)<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" aria-setsize=\"-1\" data-aria-posinset=\"4\" data-aria-level=\"1\"><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-26858\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2021-26858<\/a>\u00a0| Microsoft Exchange Server Remote Code Execution Vulnerability (public)<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" aria-setsize=\"-1\" data-aria-posinset=\"5\" data-aria-level=\"1\"><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-27065\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2021-27065<\/a>\u00a0| Microsoft Exchange Server Remote Code Execution Vulnerability (public)<\/li>\n<\/ul>\n<h3>Check for Indicators of Compromise<\/h3>\n<p>Microsoft has\u00a0<a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/\" target=\"_blank\" rel=\"noopener noreferrer\">released<\/a>\u00a0excellent documentation around the\u00a0IoCs\u00a0for these attacks.\u00a0After patching, you should ensure that your\u00a0client\u2019s\u00a0environment was not impacted by this threat activity. If you find signs of compromise, patching is not enough. Attackers will often leave other backdoors, allowing them access even after you patch. This is even more likely to occur now as the threat actors are aware that patches are being deployed and will look to persist their access. Act to identify and remediate other backdoors or exploits in the environment.<\/p>\n<h3>Harden Your Exchange Environments<\/h3>\n<p>The prevalence of zero-day incidents has been increasing over time. Traditional methods of deploying endpoint protection to servers is not enough. You must take a proactive, &#8220;assume breach&#8221; approach to securing on-premises infrastructure.<\/p>\n<p>To aid this, you should consider leveraging a managed SOC (Security Operations Center) vendor (SOC as a Service) such as\u00a0<a href=\"https:\/\/www.pax8.com\/vendors\/rocketcyber\/\" target=\"_blank\" rel=\"noopener noreferrer\">RocketCyber<\/a>\u00a0or\u00a0<a href=\"https:\/\/www.pax8.com\/vendors\/novacoast\/\" target=\"_blank\" rel=\"noopener noreferrer\">NovaSOC<\/a>. These\u00a0Pax8\u00a0vendors\u00a0offer free 30-day trials and\u00a0specialize in staying on top of these threats and their associated Indicators of Compromise and will go hunting for them. This proactive approach can alert you to a potential threat, empowering you to remediate immediately.<\/p>\n<p>The exploits we\u2019re discussing today were in no way connected to the separate SolarWinds-related attacks. Microsoft continues to see no evidence that the actor behind SolarWinds discovered or exploited any vulnerability in Microsoft products and services.<\/p>\n<h2>Planning Your Next Steps: Moving to the Cloud<\/h2>\n<p>Once you have plugged the holes, it is time to look at the next steps for ensuring long term security. There are two key paths to consider.<\/p>\n<p>Zero-days impacting on-premises software is nothing new. Clients\u00a0in the Microsoft 365 ecosystem benefit from Microsoft\u2019s multi-billion-dollar security investments and extensive team of cyber security professionals.<\/p>\n<p>While no environment is immune to these sophisticated attacks, Microsoft\u2019s investment, and security posture position them as a formidable player in prevention, detection, and rapid remediation.<\/p>\n<p>Reach\u00a0out to\u00a0<a href=\"https:\/\/www.pax8.com\/professional-services\/\" target=\"_blank\" rel=\"noopener noreferrer\">Pax8 Professional Services<\/a>\u00a0to\u00a0plan your\u00a0client\u2019s move to Microsoft 365.<\/p>\n<h2>More Resources &amp; Information<\/h2>\n<p>For more information, you can\u00a0access additional resources here:<\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2021\/03\/02\/new-nation-state-cyberattacks\/\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft On the Issues blog<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/www.microsoft.com\/security\/blog\/2020\/06\/24\/defending-exchange-servers-under-attack\/\" target=\"_blank\" rel=\"noopener noreferrer\">Defending Exchange servers under attack<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/msrc-blog.microsoft.com\/?p=12819\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Security Response Center (MSRC) release &#8211; Multiple Security Updates Released for Exchange Server<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/released-march-2021-exchange-server-security-updates\/ba-p\/2175901\" target=\"_blank\" rel=\"noopener noreferrer\">Released: March 2021 Exchange Server Security Updates<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/released-march-2021-exchange-server-security-updates\/ba-p\/2175901\" target=\"_blank\" rel=\"noopener noreferrer\">Exchange Team Blog<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/\" target=\"_blank\" rel=\"noopener noreferrer\">MSTIC Blog<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/msrc-blog.microsoft.com\/2021\/03\/02\/multiple-security-updates-released-for-exchange-server\" target=\"_blank\" rel=\"noopener noreferrer\">MSRC Blog<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/microsoft.sharepoint.com\/:w:\/t\/SSIRP21001Newman\/ET9YzwHAMi5Fg8Ao9EQQUzEBs9VkyzWS9DGNqZRTONOWpg?e=xfMucS\" target=\"_blank\" rel=\"noopener noreferrer\">Out of Band Exchange Release Customer Alert<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/\" target=\"_blank\" rel=\"noopener noreferrer\">Security Update Guide<\/a><\/p>\n<p><strong>\u2022 <\/strong><a href=\"https:\/\/www.pax8nebula.com\/m\/3d076df7160f8958\/original\/Microsoft-Exchange-Cyberattack_Update-03-03-2021.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">Pax8 Resource: Microsoft Exchange Cyberattack Information<\/a><\/p>\n<p>Don\u2019t wait to\u00a0take action\u00a0on this extremely urgent cybersecurity\u00a0risk.\u00a0Following the immediate actions listed above, the best way to avoid future attacks is to\u00a0move your business off-prem. To do this, talk with your Cloud Wingman today or\u00a0work with our\u00a0Pax8 Professional Services\u00a0team\u00a0to\u00a0ensure that\u00a0you\u00a0and your clients\u2019 Microsoft environment stays safe and secure.<\/p>\n<p><a class=\"btn-primary\" href=\"https:\/\/player.vimeo.com\/video\/519248155\">Watch the video<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last updated on Wednesday, March 10, 2021 at 4:30pm\u00a0MT. Immediate actions to take to protect your clients and your business. On Tuesday, March 2, 2021, Microsoft announced that they\u00a0identified new nation-state cyberattacks, named\u00a0HAFNIUM,\u00a0using previously unknown exploits that target\u00a0vulnerabilities in\u00a0the company\u2019s on-premises Exchange Server software. In the attacks observed, the threat actor used these vulnerabilities to [&hellip;]<\/p>\n","protected":false},"author":141,"featured_media":85,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[19,10,7],"tags":[],"class_list":["post-1358","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-infrastructure","category-microsoft","category-pax8-partners"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Protect against HAFNIUM 0-Day Exploits - Pax8 Blog<\/title>\n<meta name=\"description\" content=\"Here&#039;s what you need to know and do to protect your on-premises Microsoft Exchange servers from falling victim to a HAFNIUM attack.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pax8.com\/blog\/alert-hafnium\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Protect against HAFNIUM 0-Day Exploits - Pax8 Blog\" \/>\n<meta property=\"og:description\" content=\"Here&#039;s what you need to know and do to protect your on-premises Microsoft Exchange servers from falling victim to a HAFNIUM attack.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pax8.com\/blog\/alert-hafnium\/\" \/>\n<meta property=\"og:site_name\" content=\"Pax8 Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-03T20:55:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-17T00:59:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/Hafnium-Microsoft-Exploit-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1002\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"narnold\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"narnold\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/\"},\"author\":{\"name\":\"narnold\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#\\\/schema\\\/person\\\/4f1f5ecebcf730cc2be7b763a310a63c\"},\"headline\":\"Protect against HAFNIUM 0-Day Exploits\",\"datePublished\":\"2021-03-03T20:55:00+00:00\",\"dateModified\":\"2023-05-17T00:59:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/\"},\"wordCount\":997,\"publisher\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/Hafnium-Microsoft-Exploit-1.png\",\"articleSection\":[\"Infrastructure\",\"Microsoft\",\"Pax8 partners\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/\",\"name\":\"Protect against HAFNIUM 0-Day Exploits - Pax8 Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/Hafnium-Microsoft-Exploit-1.png\",\"datePublished\":\"2021-03-03T20:55:00+00:00\",\"dateModified\":\"2023-05-17T00:59:41+00:00\",\"description\":\"Here's what you need to know and do to protect your on-premises Microsoft Exchange servers from falling victim to a HAFNIUM attack.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/Hafnium-Microsoft-Exploit-1.png\",\"contentUrl\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/Hafnium-Microsoft-Exploit-1.png\",\"width\":1920,\"height\":1002},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/alert-hafnium\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Protect against HAFNIUM 0-Day Exploits\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/\",\"name\":\"Pax8 Blog\",\"description\":\"Where IT pros go to keep up with the cloud\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#organization\",\"name\":\"Pax8 Blog\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/pax8-logo-white-blog-300x300-1.png\",\"contentUrl\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/pax8-logo-white-blog-300x300-1.png\",\"width\":300,\"height\":300,\"caption\":\"Pax8 Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#\\\/schema\\\/person\\\/4f1f5ecebcf730cc2be7b763a310a63c\",\"name\":\"narnold\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/author\\\/narnold\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Protect against HAFNIUM 0-Day Exploits - Pax8 Blog","description":"Here's what you need to know and do to protect your on-premises Microsoft Exchange servers from falling victim to a HAFNIUM attack.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/","og_locale":"en_US","og_type":"article","og_title":"Protect against HAFNIUM 0-Day Exploits - Pax8 Blog","og_description":"Here's what you need to know and do to protect your on-premises Microsoft Exchange servers from falling victim to a HAFNIUM attack.","og_url":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/","og_site_name":"Pax8 Blog","article_published_time":"2021-03-03T20:55:00+00:00","article_modified_time":"2023-05-17T00:59:41+00:00","og_image":[{"width":1920,"height":1002,"url":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/Hafnium-Microsoft-Exploit-1.png","type":"image\/png"}],"author":"narnold","twitter_card":"summary_large_image","twitter_misc":{"Written by":"narnold","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/#article","isPartOf":{"@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/"},"author":{"name":"narnold","@id":"https:\/\/www.pax8.com\/blog\/#\/schema\/person\/4f1f5ecebcf730cc2be7b763a310a63c"},"headline":"Protect against HAFNIUM 0-Day Exploits","datePublished":"2021-03-03T20:55:00+00:00","dateModified":"2023-05-17T00:59:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/"},"wordCount":997,"publisher":{"@id":"https:\/\/www.pax8.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/Hafnium-Microsoft-Exploit-1.png","articleSection":["Infrastructure","Microsoft","Pax8 partners"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/","url":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/","name":"Protect against HAFNIUM 0-Day Exploits - Pax8 Blog","isPartOf":{"@id":"https:\/\/www.pax8.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/#primaryimage"},"image":{"@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/Hafnium-Microsoft-Exploit-1.png","datePublished":"2021-03-03T20:55:00+00:00","dateModified":"2023-05-17T00:59:41+00:00","description":"Here's what you need to know and do to protect your on-premises Microsoft Exchange servers from falling victim to a HAFNIUM attack.","breadcrumb":{"@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pax8.com\/blog\/alert-hafnium\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/#primaryimage","url":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/Hafnium-Microsoft-Exploit-1.png","contentUrl":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/Hafnium-Microsoft-Exploit-1.png","width":1920,"height":1002},{"@type":"BreadcrumbList","@id":"https:\/\/www.pax8.com\/blog\/alert-hafnium\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pax8.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Protect against HAFNIUM 0-Day Exploits"}]},{"@type":"WebSite","@id":"https:\/\/www.pax8.com\/blog\/#website","url":"https:\/\/www.pax8.com\/blog\/","name":"Pax8 Blog","description":"Where IT pros go to keep up with the cloud","publisher":{"@id":"https:\/\/www.pax8.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pax8.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.pax8.com\/blog\/#organization","name":"Pax8 Blog","url":"https:\/\/www.pax8.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pax8.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/pax8-logo-white-blog-300x300-1.png","contentUrl":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/pax8-logo-white-blog-300x300-1.png","width":300,"height":300,"caption":"Pax8 Blog"},"image":{"@id":"https:\/\/www.pax8.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.pax8.com\/blog\/#\/schema\/person\/4f1f5ecebcf730cc2be7b763a310a63c","name":"narnold","url":"https:\/\/www.pax8.com\/blog\/author\/narnold\/"}]}},"_links":{"self":[{"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/posts\/1358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/users\/141"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/comments?post=1358"}],"version-history":[{"count":0,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/posts\/1358\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/media\/85"}],"wp:attachment":[{"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/media?parent=1358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/categories?post=1358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/tags?post=1358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}