PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Hafnium and Exchange: what proves recovery after patching?
An installed patch and an available service answer different questions. A review must connect the update, investigation and the conditions for returning to operation.
By Pentesty
The news and its limits
Rewards for Justice offers up to $10 million for information related to Zhang Yu, whom the US government associates with Hafnium and attacks on Exchange in 2021. The criminal allegations remain charges. Microsoftâs 2021 account described the need to investigate compromise alongside installing updates. That is historical context, not an assessment of a current environment.
Three questions for different decisions
The first question is whether the installed version is patched and appropriately supported. The second is whether there are signs of unauthorized access during the relevant period. The third is whether the service can support business operations again with defined controls and responsibilities. One green dashboard field cannot answer all three.
This separation prevents two shortcuts. A completed update alone does not demonstrate the absence of earlier changes; an investigation that finds no indicators does not demonstrate that software is current. Record the outcome of each workstream, the sample examined and what remained outside the assessmentâs coverage.
Start with the service the business actually operates
Confirm which components the organization administers, which depend on a supplier and who owns each decision. On-premises Exchange and Microsoft 365 are not interchangeable environments. Documentation needs to reflect the actual service, including internally maintained integrations and dependencies, without automatically applying an old procedure to a different architecture.
Build a timeline of known changes, log retention periods and containment decisions. If records are missing for a period, make the gap explicit. Do not turn missing records into proof that nothing occurred. This discipline helps scope further investigation without assuming that a current incident has the characteristics of a historical attack.
Closure must survive a team handover
Organize the handover around decisions, rather than attachments alone. The receiving team should find the reason for closure, evidence locations, the owner responsible for preserving records and the events that require reopening. Separate direct observations from hypotheses that still need investigation.
Apply the same expectation to the supplier. A statement that service is normal needs to identify the criterion used and the part of the environment covered. Protect the collected material: evidence of recovery need not circulate with messages, secrets or personal information that do not contribute to the decision.
Review the process without assuming attribution
A reward seeking information does not establish that your companyâs incident is connected to the person under investigation. Similarly, an indicator resembling a known campaign is a lead to investigate, not an automatic conclusion about responsibility. Preserve the distinction between public intelligence and evidence from your environment.
The practical value lies in testing the ability to patch, investigate and recover against your own criteria. Review that capability after significant changes to architecture, suppliers or personnel. The response should remain understandable when the analyst who handled the case is unavailable.
Frequently asked questions
Does the reward mean there has been a conviction?
No. The program seeks information while criminal allegations follow their legal process. A reward does not establish guilt or prove a connection to a particular incident.
Does installing the update close an investigation?
An update addresses the softwareâs condition. Closure also depends on investigative questions and the operational criteria defined for the environment and the period examined.
Does the 2021 procedure apply to every current Exchange deployment?
The publication provides historical context. A current assessment needs to confirm architecture, versions, support and applicable guidance before defining tests or actions.
What evidence should accompany closure?
The record should show what was checked, coverage, limitations, recovery decisions and their approvers. A conclusion without evidence available for review is difficult to substantiate.
Sources and references
- Rewards for Justice: Zhang Yu notice
- U.S. Department of Justice: related case, April 27, 2026
- Microsoft: historical Exchange guidance, March 2, 2021
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.