Released: March 2021 Exchange Server Security Updates

jimmygrec 

The thing to realize is that when vulnerabilities were publicly disclosed, others (not just HAFNIUM) had the necessary knowledge to start exploiting the vulnerabilities. Based on what I have seen, vast majority of entries in logs that I have seen are from the day of disclosure and later (vs. earlier, which would be a stronger indication of HAFNIUM related activity). As it usually happens with those things, when vulnerabilities get disclosed, all kinds of other actors jump in and start exploiting the vulnerability.

And this is why we are urging folks to update immediately and not wait for anything. Update now, ask questions later. Don't even search the logs; update and then search the logs. Updating will not wipe the logs.