From gbhackers.com
Multiple APT actors attempting to exploit recently patched remote code execution bug in exchange email servers. The vulnerability can be tracked as CVE-2020-0688. It affects all versions of the exchange server.
The bug resides in the Exchange Control Panel (ECP) component, which can be used to manage mailboxes, Distribution Groups, Contacts at the mailbox level and several other objects at the Organization level.