Hafnium Hack – How to run the patches, with simple detailed instructions.

Hafnium Hack – How to run the patches, with simple detailed instructions.

Why make such a “How to”? 
Because all articles we found so far, talk about what to do, but none shows how to do it.

So let’s start.



Before you can apply the “.msb” patch you need to have the latest CU already installed!

3. run your Exchange patch

After the CU is installed then you can run your Exchange patch.

4. Block suspicious IPs

According to Cisa.gov, a number of servers were reported as suspicious: https://us-cert.cisa.gov/ncas/alerts/aa21-062a

  • 103.77.192[.]219
  • 104.140.114[.]110
  • 104.250.191[.]110
  • 108.61.246[.]56
  • 149.28.14[.]163
  • 157.230.221[.]198
  • 167.99.168[.]251
  • 185.250.151[.]72
  • 192.81.208[.]169
  • 203.160.69[.]66
  • 211.56.98[.]146
  • 5.254.43[.]18
  • 5.2.69[.]14
  • 80.92.205[.]81
  • 91.192.103[.]43

For extra security we decided to block  the above IPs both for WAN and LAN traffic (incoming and outgoing connections) into our firewall.

After some hours we noticed WAN traffic coming in from those IPs: It seems they tried to see if the Exchange server was still available for whatever they intended to do..

latest posts

GPT-3 vs GPT-4 improvements differences

GPT-4 builds upon the success of its predecessor, GPT-3, by offering several improvements in various aspects. While both models are based on the Transformer architecture, GPT-4 has several advancements over...

Ransomware severs 1,000 ships from on-shore servers

A Norwegian company specializing in maritime risk management faced a ransomware attack on January 7th 2023 that caused its ShipManager software to go offline, resulting in 1,000 ships losing their...

How important is to keep data backups isolated from malware.

Keeping regular backups of your data is essential in today's digital age. There are many reasons why data backups are important, including: Data Loss Prevention: Accidents happen, and hard drives...

Hyper-V How to Fix Virtual machine could not be started because the hypervisor is not running

After a client's power failure where the UPS failed to properly shutdown the Hyper-V Server, VMs were not able to start. See below for the error we got every time...