The FBI is Hacking Exchange Servers…to FIX Them!


April 15, 2021

The headline isn’t clickbait, I promise. The Federal Bureau of Investigations is hacking into Microsoft Exchange Servers across the country to…protect them from Hafinum.
We’ve previously written about the problems facing unpatched Exchange Servers here on the Security7 blog. So you don’t have to leave this page (though you can if you click on those links) we’ll summarize what’s going on here.

In March of this year, Microsoft announced four vulnerabilities that, when combined, used their powers for evil! Well, sort of. When the four vulnerabilities were exploited in conjunction, it allowed for hackers to break into Exchange Servers and steal sensitive data.
Microsoft released patches that took care of the vulnerabilities shortly thereafter.

Unfortunately, if an Exchange Server had previously been breached BEFORE the patch was installed, it was hosed and there was no way to close the backdoor. Yadda, yadda, yadda, nature abhors a vacuum, and hackers across the world were using these doors to deploy ransomware.
This is where the Justice Department and the FBI come in. Earlier this week a court in Houston, TX gave the two agencies permission to “copy and remove” the backdoors from the impacted Exchange Servers.

The details remain…sparse. But basically, the FBI has been permitted to access impacted Exchange Servers, issuing a command through the malicious web shell to the server and delete it (the web shell, not the server).

After this is done, the FBI has said they’re notifying server owners via email to let them know the jobs have been done…even though they had no idea the job was being done in the first place. If I’m being honest (and I try to be), getting an unsolicited email from the “FBI” informing me they’d been in my Microsoft Exchange Server with what is essentially a “bottle of bleach and a rag,” I’d be fairly suspicious.

Anyways…the Justice Department has said that even though they’re cleaning up the Exchange Servers, they’re not updating them, and installing Microsoft’s patches will still be necessary.

Like our blog? Subscribe using the CTA in the upper right-hand corner of this page. Feel like sharing your thoughts with us? Use the comment section below.

Don’t forget to follow us on LinkedIn and Twitter

Carl Keyser is a Digital Marketing Specialist at Integris.

Keep reading

Managed IT Services St. Paul: 5 Powerful Advantages for Businesses

Managed IT Services St. Paul: 5 Powerful Advantages for Businesses

As a business owner, it's important to make the most of your resources. This includes finding cost-effective solutions for managing and maintaining your company's technology. Keeping a competitive edge in your industry requires secure, modern tech that allows your...

IT Support Minneapolis: Where to Find Top IT Services in Minneapolis

IT Support Minneapolis: Where to Find Top IT Services in Minneapolis

If you’re wondering where to find top IT services in Minneapolis, it’s important to identify providers that offer a wide range of support, have great service and provide solid tech expertise. Comprehensive technology insight is especially important when it comes to IT...

Webinar: Email Security that Doesn’t Suck…

Webinar: Email Security that Doesn’t Suck…

Trustifi and Security 7 present Email Security That Doesn’t Suck.  In today’s age of over-complicated security tools, it is extremely difficult to manage the fine balance between security and productivity.   {% video_player "embed_player" overrideable=False,...