Initially, the blue team at GTSC observed attacks Exchange in August 2022. The details were shared with Microsoft via Trend Micro ZDI. As other attacks were observed by GTSC before any official patch was released they decided to publish their write-up.
Initially, there was a bit of confusion whether this was again the ProxyShell vulnerability from 2021. Kevin Beaumont did an initial analysis and later create a logo.
Later, the Microoft Security Response Center also published guidance on the vulnerabilities, now tracked as CVE-2022-41040 and CVE-2022-41082. A follow-up covers how the mitigations got bypassed several times within a week.