FBI Disrupts Chinese State-Sponsored Exploitation of Microsoft Exchange Vulnerabilities

• •FBI operation targeted Chinese state-sponsored web shells on Microsoft Exchange.
• •Malicious web shells exploited zero-day vulnerabilities, affecting numerous U.S. systems.
• •FBI used remote access techniques to remove malware without user consent.

On April 13, 2021, the FBI executed a novel operation to remove malicious web shells from U.S.-based computers, attributed to the Chinese state-sponsored group Hafnium. These web shells exploited zero-day vulnerabilities in Microsoft Exchange servers, allowing unauthorized access and persistent malware deployment. Despite prior mitigation efforts, hundreds of web shells remained on affected systems. The FBI's warrant permitted remote access to copy and delete these web shells without the owners' knowledge. The operation targeted systems with particularly difficult-to-detect web shells, which had unique file names. The warrant was partially unsealed following the operation's conclusion, allowing the FBI to notify victims through emails and public postings. The FBI's actions represent a significant escalation in countering state-sponsored cyber threats.