H is for Hafnium — The Smash-and-Grab, or the Zero-Day Sprayed Across the World

The Alphabet of Actors — Letter H. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED.

The state actors in this register have, so far, been careful. Chengdu 404 (Letter C) was surgical — a precise dual-purpose operator that chose its targets. Equation Group (Letter E) was patient and stealthy to the point of reflashing hard-drive firmware. The GRU (Letter G) was deniable, working through cut-outs. Espionage, done well, is quiet; a good intelligence operation is one the target never notices. Hafnium is the letter about a state actor that did the opposite — that took one of the most valuable capabilities in cyber, a working zero-day against the mail server half the world runs on, and used it as loudly, as broadly, and as recklessly as possible.

Hafnium is Microsoft's name for the group, assessed as operating from China and later attributed by a coalition of governments to actors affiliated with the Ministry of State Security, that in early 2021 exploited a chain of four previously-unknown vulnerabilities in Microsoft Exchange. The chain is remembered as ProxyLogon, and what Hafnium did with it is the subject of this letter — not because the espionage was sophisticated, but because of what happened when a state stopped being surgical and started spraying. It web-shelled tens of thousands of servers across the internet, indiscriminately, in a race against the patch, and left behind a mess that the entire criminal and state ecosystem then fed on for months.

This is the letter about the smash-and-grab: the mass-exploitation model in which the harm is not the secret stolen from a real target but the collateral compromise of everyone else, and the durable damage is not what was taken but what was left behind.

1. The Actor: a state actor that chose to be loud

Every earlier state actor in this register prized quiet. Hafnium is defined by its noise. In early 2021 it possessed something extraordinarily valuable — a chain of four zero-day vulnerabilities in Microsoft Exchange, the on-premises mail server used by an enormous number of organisations worldwide, that led from an unauthenticated request all the way to a web shell running on the server. A capability like that is, in the espionage economy, a jewel. The disciplined thing to do with it is to use it sparingly, against high-value targets, and guard it so it stays secret and usable for as long as possible.

Hafnium did the sparing, disciplined thing first, and then abandoned it. The operation began, by the available accounting, as targeted intrusion. But as disclosure approached — as Microsoft prepared a patch and security researchers closed in — it escalated into something else entirely: a global spraying campaign, an attempt to compromise as many internet-facing Exchange servers as possible before the window slammed shut. The MITRE-tracked group name and the coalition attribution matter less, for this letter, than that decision. A state actor, holding a precision weapon, chose in its final days to fire it in every direction at once.

This dossier holds its standard line on attribution: Hafnium as a China state-sponsored actor is Microsoft's assessment, corroborated by a July 2021 attribution from the United States, the European Union, the United Kingdom, NATO and other allies to actors affiliated with China's Ministry of State Security — a high-confidence, unusually coordinated attribution, stated as assessment, not as a court verdict, because no perpetrator was ever tried. What is not in doubt, because it happened on the open internet and was measured by defenders worldwide, is the scale and the recklessness of what followed.

2. The Instrument: ProxyLogon, and the race against the patch

The technical shape of the thing matters, because it explains both the power and the panic. The vulnerability chain, ProxyLogon, began with a server-side request forgery in Exchange — CVE-2021-26855 — that let an attacker send a request the server would treat as authenticated, without any credentials at all. Chained with the others (including CVE-2021-27065), that pre-authentication foothold led to arbitrary code execution and the writing of a web shell onto the server. No password, no phishing, no user to trick: just an internet-facing Exchange server and a crafted request, and the attacker owned the mail system.

On 2 March 2021, Microsoft and the security firm Volexity disclosed that this was being actively exploited, and shipped emergency patches. And here the structural incentive that governs every zero-day took over, and turned an espionage tool into an internet-wide catastrophe. A zero-day is worth the most in the instant before it is patched and close to nothing soon after, because once the patch is out, defenders begin closing the door. So the moment disclosure became imminent, the rational move — rational in the cold economic sense, monstrous in effect — was to exploit as widely and as fast as possible while the key still worked. Grab everything now, because tomorrow the door closes.

That is what turned a targeted operation into a spray. The archive captures the speed of the commoditisation that followed: within days of disclosure, the PoC-in-GitHub collection filled with public proof-of-concept exploits for CVE-2021-26855, and the detection rules the LSN corpus holds — the Sigma signatures for the tell-tale Set-OabVirtualDirectory web-shell write, the alerts for a process spawned by the Exchange worker w3wp.exe — are all dated to that frantic March. A pre-authentication key to the world's mail servers, disclosed and racing a patch, produced exactly the incentive to use it on everyone, and that is what Hafnium did.

3. The Harm: the collateral, and the mess left behind

The distinctive harm of the smash-and-grab is not measured in the secrets Hafnium actually read. It is measured in the tens of thousands of organisations that had no secrets worth reading and were compromised anyway.

When you spray a zero-day across every internet-facing Exchange server you can find, you do not hit intelligence targets. You hit dentists' offices, town councils, small manufacturers, charities, school districts — the vast population of ordinary organisations that happen to run their own mail server and had no idea they were on any front line. Estimates of the compromised population ran into the tens of thousands globally. None of these were targets in any meaningful sense; they were simply reachable, and reachable was the only selection criterion the smash-and-grab applied. The harm is the indiscriminateness itself: a state intelligence operation whose victims were overwhelmingly bystanders it had no interest in, breached because breaching them was fast and free.

And then there is the residue, which is the part that makes the Exchange event genuinely catastrophic rather than merely large. The operators did not just look; they left web shells — standing backdoors — on the servers they compromised, tens of thousands of them, many of which they almost certainly never returned to. Those shells did not evaporate when the story broke. They sat there, on tens of thousands of under-resourced organisations' servers, as open doors. And once the vulnerability was public, a feeding frenzy began: multiple other state and criminal groups piled onto the still-unpatched servers and the shells already sitting on them, and a ransomware strain called DearCry weaponised ProxyLogon directly to encrypt victims. One state actor's smash-and-grab did not just compromise a population; it pre-breached that population and handed the keys to the entire threat ecosystem. The mess was the harm, and the mess had no owner — Hafnium moved on, and everyone else moved in.

There is a cruel asymmetry buried in who got hit. By 2021, the large, well-resourced organisations had largely moved their mail to the cloud, where a vendor's security team patches for them within hours. The organisations still running their own on-premises Exchange server were disproportionately the ones that could least afford a security team to run it \u2014 the small district, the regional non-profit, the mid-sized manufacturer \u2014 which meant the smash-and-grab's victims were selected, in effect, for their inability to defend themselves or to clean up afterward. The same populations then had to discover the intrusion, find the web shells, and rebuild, mostly without the expertise to do any of it. Recklessness at the top of the capability pyramid lands hardest at the bottom of the resource pyramid, and the Exchange event is a near-perfect illustration: the state actor bore no cost, and the school district with one overworked IT administrator bore most of it.

4. The Accountability: when you cannot reach the actor, fix the victim

Hafnium is, like the PRC actors of Letter C and every state actor in this register, beyond the reach of any Western court. The July 2021 coalition attribution to China's Ministry of State Security named the responsible service, and it changed the operators' situation by nothing — no arrest, no trial, no cessation. On the axis of punishing the perpetrator, the Exchange event is another entry in the zero-accountability ledger.

But it introduced a mode of consequence this register had not yet recorded, and it is worth dwelling on because it points at the only kind of accountability that actually scales against unreachable actors: not punishing the perpetrator, but repairing the harm. In April 2021, the FBI obtained a court order authorising it to remotely access compromised Exchange servers on US networks and delete the web shells the attackers had left behind — reaching into thousands of private victims' systems, with judicial authorisation, to close the doors the victims themselves had not managed to close. It was novel and not uncontroversial: a law-enforcement agency remotely modifying private servers, even to help, is a serious step. But it was aimed squarely at the residue, at the standing backdoors, and it removed a great many of them. CISA issued an emergency directive; Microsoft shipped a one-click mitigation tool that a non-expert could run.

Set that beside the earlier letters' accountability modes — the court (Amesys), the export fine (Blue Coat), the unenforceable indictment (Chengdu 404), the disruption and clawback (DarkSide), the exposure that did not deter (the GRU). Hafnium adds remediation: when the actor is untouchable and the harm is a mess of backdoors on innocent servers, you can at least send someone to clean up the mess. It is not justice, and it does not touch the perpetrator. But it is the one response that engages the actual harm rather than the actor, and against a smash-and-grab whose damage is collateral, cleaning up the collateral may be the most consequential thing anyone can do.

5. The Bridge: the honeypot's daily weather

Every letter carries the actor to what the LSN systems see, and Hafnium's bridge is the most native in the entire register, because mass exploitation and web-shelling are not something the honeypot occasionally glimpses — they are its daily, hourly, constant traffic.

The web-threats classifier's top intents include shell_upload — an attempt to drop a web shell onto a server — and cms_detect — an attempt to fingerprint an internet-facing application for a known exploit. Those two intents are the exact commodity form of what Hafnium did to Exchange at scale: find an internet-facing server, identify an exploitable flaw, drop a web shell, own the box. Historically the classifier has tagged on the order of 3,059 shell-upload and 2,980 CMS-detection attempts. The honeypot cannot watch Hafnium web-shell a specific corporate Exchange server, but it watches the identical technique, from every corner of the internet, without pause — because the smash-and-grab is not a special event, it is the background radiation of the modern internet, and a honeypot is a Geiger counter held up to it.

And the platform holds the other half too. The LSN archive carries apt_hafnium.yar, the detection signatures for exactly the forensic artefacts Hafnium left — the web-shell patterns, the credential-dump command, the reverse shell. So the platform can both measure the commodity version of the modality as it streams past and name the specific state instance of it when its fingerprints appear. What it cannot do — what no one could do to Hafnium — is reach the actor. It can detect the smash-and-grab, count it, name it, and clean up after it, which is precisely the set of things the Exchange response actually consisted of. The bridge is not a comparison; it is a description of the honeypot's job in the mass-exploitation era.

6. The counter-narrative, steelmanned

The strongest defence of Hafnium's conduct is a narrow one, and it deserves to be stated precisely because the narrowness is the point.

Zero-day exploitation of a foreign adversary's systems is, the argument runs, legitimate espionage — every capable state does it, and Exchange, as a globally-deployed platform, is a reasonable collection target. The escalation to mass exploitation, on this account, was not gratuitous malice but the forced consequence of imminent disclosure: once a defender is about to patch, an intelligence service that has invested in a capability faces a use-it-or-lose-it moment, and exploiting broadly before the window closes is what any rational actor does with a wasting asset. The web shells, likewise, are standard tradecraft — persistence mechanisms, not deliberate sabotage — and the fact that other criminals later abused them is those criminals' culpability, not Hafnium's. And the whole episode, the defender might add, is at least partly Microsoft's problem: the vulnerability was in Microsoft's product, exploited before Microsoft patched it, and blaming the exploiter for a flaw the vendor shipped lets the vendor off lightly.

This dossier grants the pieces and rejects the sum. Yes, states spy; yes, Exchange is a target; yes, the disclosure window creates a use-it-or-lose-it incentive; yes, the vendor's flaw was the precondition. But the use-it-or-lose-it defence is exactly the indictment, not the exoneration, because it concedes the mechanism: the actor knew that spraying the exploit would compromise tens of thousands of bystanders it had no interest in, and did it anyway, because grabbing everything was worth more to it than the harm was worth avoiding. That is a choice to externalise catastrophic collateral onto innocents to shave a little more value from a dying asset — the same shape of choice this register condemned in Equation Group's hoarding, arrived at from the opposite direction. And 'the web shells were just persistence' does not survive contact with the scale: leaving tens of thousands of standing backdoors on under-resourced organisations, in a disclosed and actively-exploited flaw, is not incidental tradecraft; it is the reckless creation of an internet-wide hazard whose foreseeable consequence — the feeding frenzy — duly arrived. The vendor's flaw is real and belongs in its own letter. It does not absolve the actor who, knowing the flaw was about to close, chose to maximise the collateral on the way out.

7. Verdict — ATTRIBUTED, and NORMALIZED

Hafnium took a jewel of an espionage capability and, rather than guard it, spent it in a panic — spraying a pre-authentication zero-day across the world's Exchange servers in a race against the patch, compromising tens of thousands of organisations it had no reason to want, and leaving a field of standing backdoors that ransomware crews and other states promptly harvested. The espionage was almost beside the point. The event was a mass-casualty compromise of bystanders, and its worst damage was the residue.

The verdict's first word is the register's now-familiar one for a sheltered state actor: ATTRIBUTED. A coalition of governments named China's Ministry of State Security; Microsoft named the group; the platform holds the signatures. The naming was thorough and the reach was nil — no operator was touched, and the only consequence that engaged the harm at all was the FBI reaching into victims' servers to clean up the mess the actor left. Attribution without the actor, remediation without the perpetrator: the Exchange response was accountability aimed entirely at the damage, because the damage was the only reachable part.

The second word is why Hafnium earns a letter rather than a footnote: NORMALIZED. The 2021 Exchange event was not an outlier but a template. The reckless mass-exploitation of a single edge or enterprise-software flaw against a whole population of bystanders became the defining threat pattern of the years that followed — MOVEit and its hundreds of victims, Ivanti, Fortinet, Citrix, each a rerun of the same logic: find one internet-facing flaw, spray it, grab everyone, leave the mess. Hafnium did not invent mass exploitation, but it demonstrated the model at a scale and recklessness that set the pattern, and the pattern is now the water the honeypot swims in, measured in the endless shell_upload attempts streaming past the sensors every day. The actor was named once and vanished behind a border. The modality it showed the world became permanent.

The register has catalogued the surgical, the patient, the deniable, and now the reckless. Hafnium is the state actor that proved a zero-day is most dangerous not when it is hoarded, and not when it is leaked, but when it is spent — fired in every direction at once by an actor racing a clock, indifferent to who is standing in the way. The vectors do not lie: the tens of thousands of web shells were real, the feeding frenzy was real, the pattern that followed is real and current. Judge the choice to spray, and judge the world that now treats spraying as normal.

The Alphabet of Actors continues. Verdict: ATTRIBUTED, and NORMALIZED. Confidence: HIGH on the exploitation, the mass-compromise, the web-shell residue and the bridge — drawn from the ProxyLogon disclosure and the apt_hafnium and ProxyLogon detection signatures in the LSN archive, the PoC-in-GitHub commoditisation record, and the honeypot's shell_upload/cms_detect telemetry. The China/MSS attribution is stated as high-confidence multi-government assessment, not a court verdict; no perpetrator was tried. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the choice to spray a zero-day across the innocent, and the normal it became.