3 ms·

I wonder what would happen if they exploited these webshells' backdoors to delete the webshells...

• abound 2y ago
  If you're the FBI (and maybe also have a court order), you can do this [1]. If you're a grey hat hacker in Russia, you can maybe do this [2]. If you're a random person in the US, you're likely exposing yourself to a lot of (CFAA) risk. As the authors of this post note, they were careful to only receive + log traffic and not otherwise send interesting responses/engage with the webshells. [1] https://www.malwarebytes.com/blog/news/2024/02/fbi-removes-malware-from-hundreds-of-routers-across-the-us https://www.malwarebytes.com/blog/news/2024/02/fbi-removes-m... [2] https://www.zdnet.com/article/a-mysterious-grey-hat-is-patching-peoples-outdated-mikrotik-routers/ https://www.zdnet.com/article/a-mysterious-grey-hat-is-patch...