Actually, according to the brief they actually didn’t patch the servers, but only removed the web shell: “This operation was successful in copying and removing

Actually, according to the brief they actually didn’t patch the servers, but only removed the web shell: “This operation was successful in copying and removing those web shells. However, it did not patch any Microsoft Exchange Server zero-day vulnerabilities or search for or remove any additional malware or hacking tools that hacking groups may have placed on victim networks by exploiting the web shells.”