The FBI Takes a Drastic Step to Fight China’s Hacking Spree
On March 2, Microsoft warned the world that a Chinese state-sponsored hacking group called Hafnium had infected what would turn out to be tens of thousands of Microsoft Exchange servers in a weeks-long hacking blitz. While Microsoft soon released a patch, not every victim updated their systems, and hundreds of servers remained exposed. A little over a month later, the Department of Justice has now revealed, the FBI took extraordinary steps to protect those still at risk.
Court documents unsealed this week reveal that the FBI obtained a warrant to copy and delete so-called web shells—essentially a foothold into a system that hackers can use to send remote commands or malware—from hundreds of Hafnium victims. While the operation seems straightforward on a technical level, it establishes a precedent that manages to be at once both controversial and refreshingly restrained.
“This is a novel approach,” says April Doss, a former NSA lawyer who currently directs the Institute for Technology Law and Policy at Georgetown Law. “I think we’ll see it used again, but I would hope we see it used again with really careful analysis.” Rather than carefully select valuable targets, Hafnium scoured the internet for vulnerable Microsoft Exchange servers and infected as many as it could, amassing at least 30,000 victims in the United States alone and hundreds of thousands worldwide. It was a mess.
