“The espionage group is exploiting four newly-discovered flaws in Microsoft Exchange Server email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems.”
Microsoft shipped the patch on March 2 and called the attacks targeted. Three days later 30,000 US towns, small businesses and local governments had web shells on their mail servers. Patching now doesn’t remove the backdoor already sitting there. The victims are exactly the shops with no security team to notice.