"Microsoft Corp. today released software updates to plug four security holes that attackers have been using to plunder email communications at companies that use its Exchange Server products. The company says all four flaws are being actively exploited as part of a complex attack chain deployed by a previously unidentified Chinese cyber espionage group." - Krebs
This vulnerability is remotely exploitable and does not require authentication of any kind, nor does it require any special knowledge or access to a target environment. The attacker only needs to know the server running Exchange and the account from which they want to extract e-mail.
“Hafnium primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs,” Microsoft said. “HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites.” - Microsoft
Critical Path Security has released several threat intelligence feeds with indicators of these attacks and have additional resources in development.
https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds/blob/master/cps-collected-iocs.intel
It is advised that all Exchange environments be update IMMEDIATELY. If you need any assistance in this process, please do not hesitate in reaching out to the Critical Path Security team.