The Israel National Cyber Directorate emphasized that Microsoft has defined the vulnerabilities as “grave and easily exploitable.”
In its announcement, Microsoft called on users to update Exchange Server to fix four vulnerabilities in the program.
According to Microsoft, it could attribute the hack to Hafnium “based on observed victimology, tactics and procedures.”
“Even though we’ve worked quickly to deploy an update for the Hafnium exploits, we know that many nation-state actors and criminal groups will move quickly to take advantage of any unpatched systems,” Microsoft’s corporate vice president Tom Burt wrote in a blog post.
Microsoft added that Hafnium utilized “limited and targeted attacks” by working through leased virtual private servers.
Burt said that Hafnium first “would gain access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise itself as someone who should have access.”
Second, Hafnium “would create what’s called a web shell to control the compromised server remotely,” and finally it used “that remote access – run from the US-based private servers – to steal data from an organization’s network.”