FBI hacks vulnerable US computers to fix malicious malware

The FBI has been hacking into the computers of US companies running insecure versions of Microsoft software in order to fix them, the US Department of Justice has announced.

The operation, approved by a federal court, involved the FBI hacking into “hundreds” of vulnerable computers to remove malware placed there by an earlier malicious hacking campaign, which Microsoft blamed on a Chinese hacking group known as Hafnium.

Hafnium’s operation placed backdoors into “tens of thousands” of servers running Microsoft’s Exchange software, which allows businesses to manage emails, contacts and calendars for their employees. It took advantage of a weakness in the servers, now fixed, to plant the malware, which allowed the hackers to return at a later date.

Related: Documents reveal FBI head defended encryption for WhatsApp before becoming fierce critic

The FBI’s campaign uses the same weakness in the “hundreds” of servers that have still not been patched to hack the hackers – breaking into the vulnerable computers and removing the backdoors entirely.

“Today’s court-authorised removal of the malicious web shells demonstrates the Department’s commitment to disrupt hacking activity using all of our legal tools, not just prosecutions,” the US Department of Justice’s assistant attorney general, John C Demers, said.

“Combined with the private sector’s and other government agencies’ efforts to date, including the release of detection tools and patches, we are together showing the strength that public-private partnership brings to our country’s cybersecurity.”

Although the FBI’s campaign removed the malware placed by one hacker group, it did not actively fix the underlying vulnerability, meaning that affected computers may simply be reinfected in the future if their owners do not take action to protect them.

The FBI says it is “attempting” to notify all the owners of the affected computers, either by sending them an email from an official FBI email account, or emailing their internet service providers.

Benevolent hacking, also called a “white hat” hack, is rare, particularly from state actors, but not unheard-of. In 2016, a widespread weakness in internet-of-things devices led to the creation of a botnet called Mirai, which allowed criminals to seize millions of devices and direct them at websites and services, overwhelming them with traffic and crashing them.

But in 2017, a computer virus called Hajime was discovered to be infecting devices through the same weakness, and closing the door behind it. A message from the virus’s author said they were “just a white hat, securing some systems”.