# Exchange vulnerability 03-03-2021
**URL:** https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856
**Category:** george
**Created:** [March 6, 2021, 11:47pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856 "2021-03-06T23:47:47Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [March 6, 2021, 11:47pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/1 "2021-03-06T23:47:47Z")
I posted this link on Discord, but decided to drop it on the forum as well.
This is not going to be pretty.
> **[At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s...](https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/)**
>
> At least 30,000 organizations across the United States -- including a significant number of small businesses, towns, cities and local governments -- have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit...
---
### Author:  [@Viking](https://cog.discourse.group/u/Viking)
#### Post date: [March 7, 2021, 7:02am UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/2 "2021-03-07T07:02:32Z")
Yeah, this is a bad one.
---
### Author:  [@Force10](https://cog.discourse.group/u/Force10)
#### Post date: [March 8, 2021, 5:45pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/3 "2021-03-08T17:45:11Z")
Thank $Deity we’re on O365.
---
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [March 8, 2021, 7:15pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/4 "2021-03-08T19:15:31Z")
The Reddit thread(s) regarding this, especially in r\sysadmin, have been buzzing a lot. Lots of unhappy and pissed-off sysadmins trying to get to grips with this shitshow.
Some have been lucky. Some need to backup exchange data, and do a reinstall of Exchange and restore mailbox data.
---
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [March 8, 2021, 7:18pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/5 "2021-03-08T19:18:15Z")
We migrated to 0365 in November. May have been victim to this vulnerability, but can’t check the server to confirm as it has been decommissioned already.
Better say nothing to Manglement as nothing can be proven, and I don’t want to open a whoopass can of worms.
---
### Author:  [@RRabbit42](https://cog.discourse.group/u/RRabbit42)
#### Post date: [March 10, 2021, 4:19am UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/6 "2021-03-10T04:19:10Z")
Current tally is 60K globally.
---
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [March 10, 2021, 4:49am UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/7 "2021-03-10T04:49:17Z")
The “oof” meter just broke again.
---
### Author:  [@Nabiki](https://cog.discourse.group/u/Nabiki)
#### Post date: [March 10, 2021, 3:55pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/8 "2021-03-10T15:55:48Z")
We’re using Ironscales for our clients. It’s pretty good.
---
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [March 11, 2021, 3:08pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/9 "2021-03-11T15:08:46Z")
> **[Å nei! Norway's Stortinget struck by Microsoft Exchange malware](https://www.theregister.com/2021/03/11/stortinget_attack/)**
>
> 'Data has been extracted' as Swiss-cheese servers are exploited
---
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [March 11, 2021, 6:07pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/10 "2021-03-11T18:07:36Z")
I’m waiting with dread for the first crypto-malware extortion incident.
---
### Author:  [@RRabbit42](https://cog.discourse.group/u/RRabbit42)
#### Post date: [March 13, 2021, 6:12am UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/11 "2021-03-13T06:12:40Z")
It’s getting worse. The White House is warning that if a server is affected, the amount of time you’ve got to fix it is hours instead of days.
---
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [March 13, 2021, 3:26pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/12 "2021-03-13T15:26:07Z")
_ominous drum roll_
And it’s started. I was wondering when.
> **[r/sysadmin - New ransomware being used after an initial compromise of...](https://www.reddit.com/r/sysadmin/comments/m44p59/new_ransomware_being_used_after_an_initial/?utm_medium=android_app&utm_source=share)**
>
> 94 votes and 12 comments so far on Reddit
---
### Author:  [@Nabiki](https://cog.discourse.group/u/Nabiki)
#### Post date: [March 15, 2021, 9:43pm UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/13 "2021-03-15T21:43:52Z")
And today we have the major MS outage.
[https://status.office365.com/](https://status.office365.com/)
---
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [March 16, 2021, 8:16am UTC](https://cog.discourse.group/t/exchange-vulnerability-03-03-2021/1856/14 "2021-03-16T08:16:06Z")
Orifice365 emails working for us
_touch wood_