In early 2021, Microsoft Exchange servers worldwide became prime targets due to critical vulnerabilities. These security gaps were rapidly weaponized by both state-sponsored APT groups like Hafnium and financially-motivated ransomware operators such as LockBit and Conti. Trainees will investigate the exploitation chain, from initial access to data exfiltration, understanding the threat landscape's complexity.