Protect Your Exchange Server Against State-Level Email Hijacking

The other day a small accountant walked in, frantic because their Exchange server had started spitting out strange outbound mail logs. It turned out a malicious actor was pulling NATO‑linked emails straight from the server – a reminder that even modest businesses can end up on a state‑level spy’s radar. Is my Exchange server still using legacy authentication? We see this a lot: older Exchange installations still allow basic auth, which lets a password be sent in clear text. Turla’s tools can capture those credentials and then log in as a legitimate user. Switch off legacy auth in the Exchange admin centre and force modern OAuth flows. It’s a one‑hour change that stops a whole class of credential‑theft attacks. Are my email gateways patched against known Exchange vulnerabilities? The ProxyLogon chain (CVE‑2021‑26855, CVE‑2021‑26857, etc.) gave attackers remote code execution with a single crafted request. We recommend a monthly patch‑check routine – the same cadence you use for Windows updates. If you run Microsoft 365 on‑prem, the cloud & Microsoft 365 service can automate patch deployment for you. Do I have multi‑factor authentication (MFA) on all admin accounts? Turla’s operators often harvest a single admin password and then move laterally. MFA adds a second barrier that they cannot brute‑force without the physical token or phone. Enforce MFA via Azure AD Conditional Access and make sure even service accounts use app passwords only where absolutely necessary. Is my mail fl