Exchange WebShell Scrutiny

FBI has launched a mega operation to remove malicious web shells from hundreds of vulnerable computers in the US that were running on-premises versions of Microsoft Exchange Server software used to provide enterprise-level email service.

A court in Houston has authorised an FBI operation to “copy and remove” backdoors from hundreds of Microsoft Exchange email servers that have been compromised by nation-state hackers, including from China (Hafnium).

Web shells are pieces of code or scripts that enable remote administration.Other hacking groups followed suit starting in early March after the vulnerability and patch were publicised.

Many infected system owners successfully removed the web shells from thousands of computers. Others appeared unable to do so, and hundreds of such web shells persisted unmitigated.

The FBI conducted the removal by issuing a command through the web shell to the server, which was designed to cause the server to delete only the web shell.

Earlier last month Microsoft and other industry partners released detection tools, patches and other information to assist victim entities in identifying and mitigating the cyber incident.

Despite these efforts, by the end of March, hundreds of web shells remained on certain US-based computers running Microsoft Exchange Server software.