Threat Intelligence & APT BleepingComputer 1 month ago

Exchange Online outage causes email delays, 'Server busy' errors

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft is working to resolve an ongoing Exchange Online outage that is delaying email sent to and received from external domains. The company first acknowledged this incident (tracked under EX1467029 ) at 02:19 AM EDT, when it began investigating reports of intermittent "Server busy" errors. "This issue impacts users who may be attempting to send and receive email messages from external..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Exchange Online

Microsoft is working to resolve an ongoing Exchange Online outage that is delaying email sent to and received from external domains.

The company first acknowledged this incident (tracked under EX1467029) at 02:19 AM EDT, when it began investigating reports of intermittent "Server busy" errors.

"This issue impacts users who may be attempting to send and receive email messages from external domains in Exchange Online. Users may experience intermittent 'Server busy' errors, affecting multiple mailboxes," Microsoft said in a service alert seen by BleepingComputer.

"Depending on the client, the service should attempt to periodically retry sending the email previously impacted by the issue. If the initial sender received an NDR after 24-72 hours (different clients or email providers can vary), they will need to send a new email."

Microsoft says these ongoing email issues may be aggravated by anti-spam protections, which further delay affected accounts.

The company did not provide a timeline for full remediation, saying it's still investigating the issue to understand the root cause and will provide further details later today.

"Our initial investigation has identified instances where anti-spam protections may be contributing to impact for a subset of users," the company added. "We are continuing to analyse the behaviour and review service telemetry to better understand the underlying cause and determine the most effective mitigation path."

Get the report

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →