Click to Skip Ad
Closing in...

The FBI is hacking hundreds of computers in the US, but for a good reason

Cybersecurity news

A little more than a month after Microsoft disclosed a bombshell piece of cybersecurity industry news — an attack on Microsoft Exchange servers, whereby state-sponsored hackers from China were chaining together attacks on four vulnerabilities in Microsoft’s email cloud service in order to steal data — the US government just shared a pretty incredible piece of related news.

Court documents were unsealed, enabling a US Justice Department announcement that the FBI had undertaken what the department calls a successful operation to “copy and remove” backdoors remaining in hundreds of vulnerable computers around the US. The operation to remove these remaining malicious web shells was necessary, the Justice Department’s announcement says, because they could have been used “to maintain and escalate persistent, unauthorized access to US networks.” The FBI removed all of these backdoors by sending a command to the server through the web shell, which was meant to prod the server to delete only the web shell.

Today's Top Deal Luxurious bed sheets with 100,000 5-star Amazon reviews start at just $22 in this amazing sale! List Price:$23.79 Price:$22.39 You Save:$1.40 (6%) Buy Now Available from Amazon, BGR may receive a commission Available from Amazon BGR may receive a commission

“Today’s court-authorized removal of the malicious web shells demonstrates the Department’s commitment to disrupt hacking activity using all of our legal tools, not just prosecutions,” said US Assistant Attorney General John C. Demers, for the Justice Department’s National Security Division. “Combined with the private sector’s and other government agencies’ efforts to date, including the release of detection tools and patches, we are together showing the strength that public-private partnership brings to our country’s cybersecurity.”

Among other details the Justice Department shared, as part of disclosing this operation:

  • This all stems from Microsoft’s early March announcement that a hacking group used multiple zero-day vulnerabilities to target computers running Microsoft Exchange server software. Other hacking groups also used these vulnerabilities to install web shells on “thousands” of victims’ computers.
  • Despite Microsoft’s and law enforcement’s efforts to mitigate the damage, by the end of March there were apparently still hundreds of web shells remaining on US-based computers running the Microsoft Exchange server software.
  • The FBI says it’s trying to share notice of this court-approved operation to all owners and operators of the affected computers. In these cases, where contact information is publicly available, the bureau will send an e-mail message from its official account to provide the notice. Where contact information is not readily available, the FBI will send an email from that same official email account to victim’s ISPs and ask them to pass along the notice.

The announcement concludes by noting that, although the operation “was successful in copying and removing those web shells, it did not patch any Microsoft Exchange Server zero-day vulnerabilities or search for or remove any additional malware or hacking tools that hacking groups may have placed on victim networks by exploiting the web shells. The Department strongly encourages network defenders to review Microsoft’s remediation guidance and the March 10, 2021, Joint Advisory for further guidance on detection and patching.”

Today's Top Deal Amazon just kicked off a massive new sale — see all the best deals right here! Price:See Today's Deals! Buy Now Available from Amazon, BGR may receive a commission Available from Amazon BGR may receive a commission

Andy is a reporter in Memphis who also contributes to outlets like Fast Company and The Guardian. When he’s not writing about technology, he can be found hunched protectively over his burgeoning collection of vinyl, as well as nursing his Whovianism and bingeing on a variety of TV shows you probably don’t like.

Popular News