{"id":40171,"date":"2021-03-26T12:04:59","date_gmt":"2021-03-26T12:04:59","guid":{"rendered":"http:\/\/f2460888-e330-4541-b8ea-2407e6a2a8f9"},"modified":"2021-03-26T12:04:59","modified_gmt":"2021-03-26T12:04:59","slug":"exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/","title":{"rendered":"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/hub\/i\/r\/2020\/03\/06\/1ee94f13-7c0a-4664-b15e-5b9dccd7c85f\/thumbnail\/770x578\/9651f037a0df3d343fff479c312967fd\/istock-845470768.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>Many on-premises Exchange servers are being patched, but Microsoft warns that its investigations have found multiple threats lurking on already-compromised systems.<\/p>\n<p>Microsoft is raising an alarm over potential follow-on attacks targeting already compromised Exchange servers, especially if the attackers used web shell scripts to gain persistence on the server, or where the attacker stole credentials during earlier attacks.<\/p>\n<div class=\"relatedContent alignRight\">\n<h3 class=\"heading\"> <span class=\"int\">Exchange attacks<\/span> <\/h3>\n<\/p><\/div>\n<p>Microsoft released patches for Exchange on-premises systems on March 2. Four Exchange bugs were <a href=\"https:\/\/www.zdnet.com\/article\/update-immediately-microsoft-rushes-out-patches-for-exchange-server-zero-day-attacks\/\">already under attack from a state-sponsored hacking group called Hafnium<\/a>.&nbsp;<\/p>\n<p><strong>SEE: <\/strong><a href=\"https:\/\/www.techrepublic.com\/resource-library\/downloads\/security-awareness-and-training-policy\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\"><strong>Security Awareness and Training policy<\/strong><\/a><strong> (TechRepublic Premium)<\/strong><\/p>\n<p>Microsoft earlier this week said that&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/microsoft-92-of-vulnerable-exchange-servers-are-now-patched-mitigated\/\">92% of vulnerable Exchange servers had been patched<\/a> or had mitigations applied. However, cybersecurity firm <a href=\"https:\/\/www.zdnet.com\/article\/microsoft-exchange-server-attacks-theyre-being-hacked-faster-than-we-can-count-says-security-company\/\">F-Secure said &#8220;tens of thousands&#8221; of Exchange servers had already been breached<\/a>. &nbsp; &nbsp; &nbsp;<\/p>\n<p>In a new blog post, Microsoft reiterated its warning that &#8220;patching a system does not necessarily remove the access of the attacker&#8221;.<\/p>\n<p>&#8220;Many of the compromised systems have not yet received a secondary action, such as human-operated ransomware attacks or data exfiltration, indicating attackers could be establishing and keeping their access for potential later actions,&#8221; <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/25\/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities\/\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">the Microsoft 365 Defender Threat Intelligence Team notes<\/a>.&nbsp;<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\"> <\/section>\n<p>Where systems have been compromised, Microsoft urges admins to practice the principle of least privilege and mitigate lateral movement on a network.<\/p>\n<p>Least privilege will help address the common practice where an Exchange service or scheduled task has been configured with a highly privileged account to perform tasks like backups.<\/p>\n<p>&#8220;As service account credentials are not frequently changed, this could provide a great advantage to an attacker even if they lose their initial web shell access due to an antivirus detection, as the account can be used to elevate privileges later,&#8221; Microsoft notes.&nbsp;<\/p>\n<p>Using <a href=\"https:\/\/www.zdnet.com\/article\/microsoft-watch-out-for-this-new-ransomware-threat-to-unpatched-exchange-email-servers\/\">DoejoCrypt ransomware, aka DearCry, as an example<\/a>, Microsoft notes that the web shells used by that strain write a batch file to C:\\Windows\\Temp\\xx.bat. This was found on all systems hit by DoejoCrypt and may offer the attacker a route to regaining access where infections have been detected and removed.<\/p>\n<p>&#8220;This batch file performs a backup of the Security Account Manager (SAM) database and the System and Security registry hives, allowing the attackers later access to passwords of local users on the system and, more critically, in the LSA [Local Security Authority] Secrets portion of the registry, where passwords for services and scheduled tasks are stored,&#8221; Microsoft notes.&nbsp;<\/p>\n<p>Even where victims have not been ransomed, the attacker&#8217;s use of the xx.bat file allows them to explore a network via the web shell that dropped the file in the first place. The web shell also <a href=\"https:\/\/www.zdnet.com\/article\/cobalt-strike-and-metasploit-accounted-for-a-quarter-of-all-malware-c-c-servers-in-2020\/\">downloads the Cobalt Strike penetration testing kit<\/a> before downloading the ransomware payload and encrypting files. In other words, a victim may not have been ransomed today, but the attacker has left the tools on the network to do it tomorrow.&nbsp;<\/p>\n<p>The other cybercrime threat to Exchange servers comes from malicious cryptocurrency miners. The Lemon Duck cryptocurrency botnet was observed exploiting vulnerable Exchange servers. Interestingly, the operators of Lemon Duck cleaned up an Exchange server with the xx.bat file and a web shell, giving it exclusive access to the Exchange server. Microsoft also found that it was being used to install other malware rather just mining for cryptocurrency. &nbsp; &nbsp;<\/p>\n<p>Microsoft has <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/25\/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities\/\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">published numerous indicators of compromise<\/a> that network defenders can use to search for the presence of these threats and signs of credential theft.<\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you&#8217;re cleaning up a infected Exchange server, you need to look for traces of multiple threats, warns Microsoft.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":40172,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-40171","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Exchange Server attacks: Microsoft shares intelligence on post-compromise activities 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-26T12:04:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/03\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"770\" \/>\n\t<meta property=\"og:image:height\" content=\"578\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities\",\"datePublished\":\"2021-03-26T12:04:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/\"},\"wordCount\":584,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/\",\"name\":\"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg\",\"datePublished\":\"2021-03-26T12:04:59+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg\",\"width\":770,\"height\":578},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/","og_locale":"en_US","og_type":"article","og_title":"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-03-26T12:04:59+00:00","og_image":[{"width":770,"height":578,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/03\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities","datePublished":"2021-03-26T12:04:59+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/"},"wordCount":584,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/03\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/","url":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/","name":"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/03\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg","datePublished":"2021-03-26T12:04:59+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/03\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/03\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities.jpg","width":770,"height":578},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/exchange-server-attacks-microsoft-shares-intelligence-on-post-compromise-activities\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Exchange Server attacks: Microsoft shares intelligence on post-compromise activities"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/40171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=40171"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/40171\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/40172"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=40171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=40171"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=40171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}