Ten Doors In: How Flax Typhoon Actors Steal Email from Exchange and M365

Flax Typhoon used EBurst to spray 10 Exchange interfaces and Curlc4 to steal mail via EWS API. IOCs, CVEs, and detection guidance for defenders.