[AdmSmith]

Cyber attackers are scanning the internet for vulnerable Microsoft Exchange servers they can exploit to mine for cryptocurrency. “It’s basically free money rolling in for the attackers,” warn cybersecurity researchers.
https://www.zdnet.com/article/free-money-cyber-criminals-are-installing-cryptojacking-malware-on-unpatched-microsoft-exchange-servers/

[AdmSmith]

Further TTPs associated with SVR cyber actors

Network defenders should ensure that security patches are applied promptly following CVE announcements for products they manage.

read technical info with links to additional info:

https://media.defense.gov/2021/May/07/2002637232/-1/-1/0/ADVISORY%20FURTHER%20TTPS%20ASSOCIATED%20WITH%20SVR%20CYBER%20ACTORS.PDF