US and allies, including the European Union, the United Kingdom, and NATO, are officially blaming China for this year's widespread Microsoft Exchange hacking campaign. In early March 2021, Microsoft disclosed four zero-days actively being exploited in attacks targeting on-premises Microsoft Exchange servers. The vulnerabilities, collectively known as ProxyLogon, were exploited in attacks against tens of thousands of organisations worldwide. Threat actors were observed deploying web shells, cryptomining malware, and DearCry and Black Kingdom ransomware payloads on compromised servers. The Biden administration attributes "with a high degree of confidence that malicious cyber actors affiliated with People's Republic of China Ministry of State Security (PRC MSS) conducted cyber-espionage operations utilizing the zero-day vulnerabilities in Microsoft Exchange Server disclosed in early March 2021."