U.S. Takes Unprecedented Action To Disrupt State-Sponsored Exploitation Of Microsoft Exchange Zero-Day Vulnerabilities

On April 13, 2021, a federal district court granted a motion to partially unseal an FBI application and search warrant following the successful conclusion of an FBI operation to eradicate malicious web shells placed on U.S.-based computers by Chinese state-sponsored actors. The FBI's use of credentialed, remote access techniques to access, copy, and remove malware without the knowledge of the computer's owner appears to be a novel approach by the FBI in counteracting state-sponsored cyberattacks.

In the FBI's application for a Rule 41 search warrant under the Federal Rules of Criminal Procedure, the FBI cited a Microsoft report dated March 2, 2021 that identified malicious activity attributed to Hafnium, a group it associated with state-sponsored actors operating out of China. According to the application, Hafnium exploited zero-day vulnerabilities in Microsoft Exchange servers by installing unauthorized web shells designed to further compromise infected systems by