FBI shuts down web shells in hacked Exchange servers

Court approves FBI operation to remove web shells from vulnerable Exchange servers

FBI, DOJ badge on a crest

The FBI has used a search warrant to access Exchange servers vulnerable to the ProxyLogon exploit, copy the offending web shells for evidence, and then remove them.

According to the Department of Justice, though many infected system owners successfully removed the web shells from thousands of computers, the Feds moved to close down the shells because “others appeared unable to do so, and hundreds of such web shells persisted unmitigated.”

The FBI said the operation removed one early hacking group’s remaining web shells, which hackers could have used to maintain and escalate continued, unauthorized access to US networks.

The FBI conducted the removal by issuing a command to the server through the web shell that caused the server to delete only the web shell.  Because the web shells the FBI removed each had a unique file path and name, they may have been more challenging for individual server owners to detect and eliminate than other web shells, according to the FBI.

Assistant Attorney General John Demers of the Justice Department’s National Security Division said the the malicious web shells’ court-authorized removal “demonstrates the Department’s commitment to disrupt hacking activity using all of our legal tools, not just prosecution”.

“There’s no doubt that more work remains to be done but let there also be no doubt that the Department is committed to playing its integral and necessary role in such efforts,” Demers added.

Ilia Kolochenko CEO, founder, and chief architect at ImmuniWeb, told ITPro this was a wise move given exposed web shells indicate server owners are unaware of the server or grossly negligent by having unpatched and compromised system exposed to the internet.

Hacked servers are actively used in sophisticated attacks against other systems, amplify phishing campaigns and hinder investigation of other intrusions by using the breached servers as chained proxies,” Kolochenko said.

“Thus, arguably, such preventive removal may be considered a legitimate self-defense in cyberspace. In any case, neither hackers nor server owners will probably complain or file a lawsuit for unwarranted intrusion. What is interesting, is whether the FBI later transfers the list of sanitized servers to FTC or state attorney generals for investigation of bad data protection practices in violation of state and federal laws.”

In related news, the Cybersecurity and Infrastructure Security Agency (CISA) has ordered agencies to apply new security patches for vulnerable exchange servers. The updates mitigate significant vulnerabilities that affect on-premises Exchange Servers 2013, 2016, and 2019.

According to CISA, hackers could use these vulnerabilities to access and maintain persistence on the target host. It added the flaws are different from the ones disclosed and fixed in March 2021.

“CISA has determined that these vulnerabilities pose an unacceptable risk to the Federal enterprise and require an immediate and emergency action. This determination is based on the likelihood of the vulnerabilities being weaponized, combined with the widespread use of the affected software across the Executive Branch and high potential for a compromise of integrity and confidentiality of agency information,” a statement read.

Featured Resources

How to be an MSP: Seven steps to success

Building your business from the ground up

Download now

The smart buyer’s guide to flash

Find out whether flash storage is right for your business

Download now

How MSPs build outperforming sales teams

The definitive guide to sales

Download now

The business guide to ransomware

Everything you need to know to keep your company afloat

Download now

Recommended

Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
New report highlights the need for diversity in cyber security recruitment
cyber security

New report highlights the need for diversity in cyber security recruitment

28 Apr 2021
World’s biggest crypto exchange under federal investigation
cryptocurrencies

World’s biggest crypto exchange under federal investigation

14 May 2021
Cisco to acquire threat intelligence provider Kenna Security
Acquisition

Cisco to acquire threat intelligence provider Kenna Security

14 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021