Chinese state-sponsored group HAFNIUM exploited four zero-days in on-premises Microsoft Exchange starting Jan 3 2021. CVE-2021-26855 (SSRF auth bypass) chained with CVE-2021-27065 (file write) to install webshells. Allowed email access, lateral movement, persistent backdoor. ~60,000 organizations compromised worldwide before March 2 patches. After public disclosure, multiple threat actors piled on including LockBit affiliates. CISA emergency directive issued. Subsequent ProxyShell (CVE-2021-34473) and ProxyNotShell further extended Exchange exploitation.