Your server could have been compromised and the FBI was trying to mitigate the issue without you even knowing it yet.
Yesterday the Department of Justice revealed in a statement that the FBI was granted access to remove web shells that were installed on compromised web servers. These web servers are related to the Microsoft Exchange vulnerability that we reported earlier last month.
In a recent statement by the DoJ, "Many infected system owners successfully removed the web shells from thousands of computers. Others appeared unable to do so, and hundreds of such web shells persisted unmitigated."
Even though this operation occurred, it is still recommended that if you were compromised to follow Microsoft's advice to ensure your servers are properly patched. In the concluding statement from the FBI, "There's no doubt that more work remains to be done, but let there also be no doubt that the department is committed to playing its integral and necessary role in such efforts."
The FBI is in the process of letting users affective know if they removed the web shells. This example does show how proactive law enforcement may go if there are future widespread attacks in the future. If you receive an email from the FBI that is legitimate, it's imperative that you ensure your servers are patched correctly.
Unfortunately, attacks similar to this will not go away anytime soon. It is very important for your organization to keep up to date with the latest threats. New-school security awareness training can ensure your users are prepared to spot and report any suspicious activity.
ZDNet has the full story.
