Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the NSA and international partners from Australia and Canada, released comprehensive best practices to secure on-premises Microsoft Exchange Servers. This guidance addresses the persistent threat posed by attackers exploiting vulnerabilities in Exchange, especially as some versions reach end-of-life and no longer receive security updates. Key recommendations include restricting administrative access, enforcing multi-factor authentication (MFA), and implementing strong transport security measures such as TLS and HSTS to protect communications and reduce the attack surface.
Industry experts emphasize that organizations should treat this guidance as a critical call to action, urging security teams to refine threat models, conduct tabletop exercises, and foster collaboration between IT, DevOps, and business leaders. The guidance highlights the importance of consistent patching, least privilege, and segmentation as foundational defenses against ongoing threats targeting Exchange environments. Organizations are encouraged to use this opportunity to reassess their security investments and ensure robust protection for their communication infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A Cyberthrone article published guidance summarizing CISA best practices for securing Microsoft Exchange. Based on the provided reference, this is a defensive guidance publication rather than a newly disclosed exploitation event.
CISA added newly identified XWiki and VMware vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating evidence of active exploitation. The SC World reference reports this as the key development in the story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA, in collaboration with the NSA and international partners, has released new security best practices for on-premises Microsoft Exchange servers, emphasizing the urgent need for organizations to harden authentication, enforce strong network encryption, and minimize attack surfaces. The guidance specifically warns against retaining end-of-life Exchange servers in hybrid environments, as these systems remain highly vulnerable to exploitation by malicious actors. Organizations are strongly advised to decommission unsupported Exchange servers after migrating to Microsoft 365 to reduce exposure to ongoing cyber threats. In Germany, the Federal Office for Information Security (BSI) reported that 92% of public-facing Exchange servers are still running out-of-support software, just weeks after Microsoft ended support for Exchange 2016 and 2019. This widespread use of unsupported versions affects thousands of companies and public sector organizations, including hospitals, schools, and local authorities. The BSI highlighted that if new critical vulnerabilities are discovered, Microsoft will not provide patches, potentially forcing organizations to take servers offline and risking severe operational disruptions, data leaks, and ransomware attacks due to inadequate network segmentation and hardening.
Jun 29, 2026
Cybersecurity authorities including CISA and NSA, in collaboration with international partners, have issued urgent guidance to secure on-premise Microsoft Exchange Server and Windows Server Update Services (WSUS) instances. The recommendations emphasize restricting administrative access, enforcing multi-factor authentication, maintaining strict security baselines, and decommissioning end-of-life servers to mitigate ongoing threats. Organizations are urged to apply security updates promptly, enable advanced security features, and adopt zero trust principles to defend against persistent malicious activity targeting these critical Microsoft services. Simultaneously, a newly disclosed vulnerability in WSUS, tracked as CVE-2025-59287, is being actively exploited by cybercriminals to deploy the Skuld Stealer malware. Despite Microsoft's initial and subsequent out-of-band patches, attackers have leveraged the flaw to gain remote control over WSUS servers, using legitimate tools like PowerShell and cURL for malicious purposes. The exploitation prompted CISA to add the vulnerability to its list of known exploited vulnerabilities, underscoring the urgency for organizations to implement the latest security updates and follow best practices to protect their infrastructure.
Jun 29, 2026
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026