The timing is unusual. Hafnium was an incredibly widely exploited attack. Companies supporting a large number of exchange servers were reporting >50% running co

The timing is unusual. Hafnium was an incredibly widely exploited attack. Companies supporting a large number of exchange servers were reporting >50% running cobalt strike the very day of the patch release. Our internal discussions came to the view anyone not patched two days later had a close to 100% chance of backdoors and was going to have their server rebuilt rather than patched. It was absolutely unparalleled how widely exploited this actually was. My point being, I have doubts that this business made it months after the fact, unless there was something else involved. I saw a colleague building sandboxes, just put online, not yet on shodan, with this exploit being a few days old, and they would see ransomware within the hour.