ProxyLogon: the patch was the easy part

The week

On March 2, 2021, Microsoft released out-of-band security updates for four previously unknown vulnerabilities in on-premises Exchange Server, a group later known as ProxyLogon. Microsoft attributed the initial exploitation to a group it called HAFNIUM, which it assessed to be state-sponsored and operating from China. Exchange Online was not affected. The next day, CISA issued Emergency Directive 21-02, ordering federal civilian agencies to collect forensic images, look for indicators of compromise, and patch or disconnect affected servers. Within days, researchers reported that several other groups were scanning for and exploiting unpatched servers at scale. Widely reported estimates put the number of compromised organizations in the United States in the tens of thousands, many of them local governments, schools and small businesses that ran their own mail servers.

Most coverage of ProxyLogon treated it as a race to patch. That framing held for the first few days and then misled. Once exploitation spread, the patch only stopped new break-ins. For public agencies, the outcome turned on three gaps that sat around the patch, each with a different owner: an exposure gap (who knew which servers the internet could reach), a persistence gap (who looked for intruders already inside), and an ownership gap (who had the authority and budget to retire the platform). In many agencies, none of the three had an owner on March 2.

The exposure gap: knowing what faces the internet

Exchange servers were attractive targets because they are reachable from outside by design. Outlook on the web, mobile sync and autodiscover all require it. Many smaller agencies had stood these servers up years earlier, often through a contractor, and they had become part of the furniture. Some agencies also had forgotten hybrid servers left over from a partial move to the cloud, kept only to manage directory attributes.

When the advisory landed, the first question was simple: how many do we have, and where? In many organizations the honest answer took days, pieced together from firewall rules, DNS records and purchase orders. That delay mattered more than the time needed to install the update. Mass scanning began within days of disclosure, so an agency that needed three days to find its servers had already lost the race on some of them.

Closing this gap is cheap compared with what it prevents. It means an external attack surface inventory that is refreshed continuously, compared against the internal asset register, and owned by a named person. The useful test is whether the agency can answer, within an hour, which systems expose a login page or service to the internet, what version each runs, and who maintains it. An inventory that leaves out what the internet can see fails exactly when it is needed.

The persistence gap: patching did not remove intruders

The second gap was more dangerous because it was invisible. Attackers who reached a vulnerable server commonly dropped web shells, small scripts in web-accessible folders that let them return later without the original flaw. Installing Microsoft’s update closed the door but did nothing about anyone already inside. CISA’s directive recognized this by requiring forensic collection and hunting, and by telling agencies to assume compromise if they had been exposed.

For agencies without a security operations function, the response stalled here. Patching is an operations task with a clear end. Hunting is an investigation with no obvious end, and it needs skills many small IT teams lacked: reading IIS logs, checking for unexpected files in Exchange directories, and reviewing mailbox export activity. Microsoft released a one-click mitigation tool in mid-March aimed at exactly these organizations. In April, the Justice Department announced a court-authorized FBI operation that removed web shells from hundreds of servers whose owners had not done so. A federal law enforcement agency cleaning servers remotely shows where the persistence gap sat.

Closing it means separating two jobs. The person who patches should not also be the only person who decides the system is clean. Agencies that had a retainer with an incident response firm, or access to a state-run security operations center, could start hunting the same week. Others waited, and some never hunted at all. A practical control is a written rule: any critical vulnerability exploited before the patch was available triggers a compromise assessment, with evidence preserved, before the server is declared clean.

The ownership gap: who decides to retire the platform

The third gap was strategic. By 2021, the case for moving agency email to a hosted service was well understood, yet many agencies still ran Exchange on premises. The reasons were rarely technical. They included data residency concerns, procurement rules that made recurring subscription costs harder to approve than one-time capital purchases, hybrid configurations needed for directory synchronization, and the simple fact that nobody owned the decision.

ProxyLogon turned that indecision into a measurable cost. The servers that were hardest to patch quickly were the ones nobody was accountable for. The incident also gave CIOs a rare, concrete budget argument. The cost of running mail infrastructure includes staff time for emergency patching, forensic work and notification when something goes wrong, and those costs had never appeared in the business case for keeping servers in-house.

Closing this gap requires a decision record for each legacy platform: a named executive owner, a target state, a date and a funded plan. For a city or county, that may mean moving mail to a government cloud tenant within a budget cycle, with the hybrid server reduced to a management role and placed behind strict network controls. Hosted email is not risk-free, and the agency still owns identity, configuration and monitoring. But the provider carries the patching race, which a three-person IT team cannot win reliably.

None of the three fixes is mainly a technology purchase. Each is an assignment of responsibility, backed by a test that shows whether it is working. Agencies that came through ProxyLogon well were usually not the ones with the most tools. They were the ones where someone already knew that the internet-facing inventory, the hunt and the platform decision were their job.

With hindsight

Looking back from 2026, ProxyLogon started a pattern. The ProxyShell chain later in 2021 and further Exchange flaws kept on-premises mail servers on attackers’ target lists. In July 2021, the United States and its allies formally attributed the Exchange campaign to actors affiliated with China’s Ministry of State Security. CISA later formalized the exposure point for federal agencies in Binding Operational Directive 23-01 on asset visibility, issued in October 2022. Hosted email faced its own scrutiny: the Cyber Safety Review Board’s 2024 report on the Storm-0558 intrusion criticized Microsoft’s security culture, a reminder that moving to the cloud shifts risk without removing it. Exchange Server 2016 and 2019 reached end of support in October 2025, forcing the retirement decision many agencies had deferred. What held up best was the narrowest finding: organizations that could see their internet-facing assets and had someone accountable for hunting recovered faster, wherever their mail ran.