U.S. State Department Offers $10 Million Reward for Chinese National Charged in HAFNIUM Microsoft Exchange Attacks

Quick answers

What happened?

The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 HAFNIUM attacks on Microsoft Exchange Server. The campaign exploited four zero-day vulnerabilities affecting on-premises Exchange servers worldwide. The reward notice was reported by NTD this week. Authorities are pursuing accountability for the widespread compromise campaign that impacted thousands of organizations.

Which products are affected?

Microsoft Exchange Server

What should defenders do?

Organizations using on-premises Microsoft Exchange Server should ensure the server is updated to the latest cumulative update released by Microsoft in March 2021 and subsequent updates. Apply the emergency out-of-band patches addressing CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. Implement recommended mitigations including disabling HTTP access to /rpc and /rpc/ews endpoints. Monitor for indicators of compromise associated with the HAFNIUM campaign. Apply network segmentation and restrict access to Exchange administrative interfaces.