On April 13, 2021, a federal district court granted a motion to partially unseal an FBI application and warrant following the successful conclusion of an FBI operation to eradicate malicious web shells ...
On April 13, 2021, a federal district court granted a motion to partially unseal an FBI application and warrant following the successful conclusion of an FBI operation to eradicate malicious web shells placed on U.S.-based computers by Chinese state- actors. The FBI's use of credentialed, remote access techniques to access, copy, and remove malware without the knowledge of the computer's owner appears to be a novel approach by the FBI in counteracting state- cyberattacks.
In the FBI's application for a Rule 41 warrant under the Federal Rules of Criminal Procedure, the FBI cited a Microsoft report dated March 2, 2021 that identified malicious activity attributed to Hafnium, a group it associated with state- actors operating out of China. According to the application, Hafnium exploited zero-day vulnerabilities in Microsoft Exchange servers by installing unauthorized web shells designed to further compromise infected systems by gaining a persistent presence and deploying additional malware. Other observed malicious activity included stealing contents of email accounts and address books.
The Justice Department's press release the event identified the various efforts undertaken to mitigate the impact of the attack, including Microsoft's March 2 nd report, an initial joint advisory by FBI and CISA released in March, additional reports issued by CISA, and Microsoft's continued publication of tools and information to assist remediation efforts. Despite these efforts, hundreds of web shells remained on impacted systems. The web shells ultimately removed by the FBI's operation were thought to be particularly difficult to identify and remove from a technical perspective because they had unique file names or file paths, which made it unlikely that the system owner would be able to further remediate the vulnerability. The FBI's operation targeted only these systems with the more persistent web shells.
The FBI's warrant application described its plan to access the web shells and issue commands through the web shells to the software running on the systems at issue to copy (for the FBI) and then delete the web shells themselves. The warrant explicitly did not authorize the seizure of tangible property or any electronic content or functionality other than that associated with the malicious web shells.
Because the application and warrant were sealed, notice was not required to be provided to victim users or the public at large until after the conclusion of the operation. The FBI initially requested the term of the warrant to run beginning on April 9 for two weeks. But based on the timing of the partial unsealing of the application and warrant, it appears the FBI was able to move swiftly. The FBI stated that it intended to provide notice to victims of the searches via specific emails to identified victims and through postings on its and the DOJ's websites.
As companies address the potential impact of these zero-day vulnerabilities, it may be useful to remember that any removal of the web shells by the FBI would not necessarily impact other malware that may have also been deployed as a result of that functionality, and so impacted companies may need to further assess the nature and extent of any related malicious activity on their data and systems.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought your specific circumstances.
See more popular content from
HOW TO PLEAD CONSENT: Court Says “Plaintiffs Must Do More Than Merely Assert That They Did Not Consent To The Tracking Devices.”
Nevada Lawyer Features Article By Thome On Ethics And Supervision In The Modern Law Office
California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law
CIPA Reform Makes Its Way To Governor’s Desk
Consumer Counterpoint – Quick Take 6 – California Senate Bill 690 Passed, What’s ? (Video)
Seventh Circuit Upholds That Vendors Can Their Clients' BIPA Exemption
Major CIPA Reform Could Wipe Out Thousands Of Website Tracking Claims
Delaware’s Amended Privacy Law: Key Impacts On Adtech Contracts And Diligence Processes
California Poised To Narrow The Reach Of The California Invasion Of Privacy Act
New York Finalizes Rules For The SAFE For Kids Act
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
