U.S. Extradites Xu Zewei, Accused of Silk Typhoon Cyberattacks
Summary
The DOJ says Xu Zewei was extradited from Italy to the U.S. to face charges over alleged Silk Typhoon cyberattacks, including university compromises and exploitation of Microsoft Exchange Server zero-days.
Key points
- The DOJ announced that Xu Zewei, 34, was extradited from Italy to the U.S.; he appeared in a Houston federal court.
- Xu faces nine counts, including computer hacking, information theft, identity theft and damaging protected computers; the charges remain allegations.
- Court documents allege Xu and co-conspirators targeted U.S. universities and COVID-19 researchers, and that Xu reported exfiltrating information from researchers’ email accounts.
- The indictment alleges the group exploited Microsoft Exchange Server zero-day vulnerabilities from late 2020, targeting thousands of systems worldwide.
- The alleged attackers deployed web shells on vulnerable Exchange servers; the FBI later conducted a court-authorized operation to remove web shells from hundreds of U.S. systems.
- The DOJ alleges Xu acted for China’s Ministry of State Security and the Shanghai State Security Bureau. Another person named in the indictment, Zhang Yu, remains at large.
Article Details
- Event Type
- Extradition and US prosecution of an alleged state-sponsored cyber operator
- Impact
- The DOJ alleges Xu Zewei participated in attacks targeting US universities and COVID-19 researchers, including accessing and exfiltrating information from researchers’ email inboxes. Xu and co-conspirators allegedly exploited Microsoft Exchange Server zero-days in a campaign affecting thousands of systems worldwide and deployed web shells. The FBI later removed web shells from hundreds of systems in the US.
MITRE ATT&CK
T1114.002 · Remote Email CollectionAfter being directed to access researchers’ email accounts, Xu reportedly exfiltrated information from the targeted inboxes.T1190 · Exploit Public-Facing ApplicationXu and co-conspirators allegedly exploited Microsoft Exchange Server zero-day vulnerabilities on vulnerable servers.T1505.003 · Web ShellFollowing exploitation of Exchange servers, the hackers deployed web shells to obtain remote access.
Threat Actors
China’s Ministry of State Security (MSS)The DOJ says Xu conducted cyberattacks on behalf of the MSS; the article also says he reported successful compromises to its officers.HafniumThe article identifies Hafnium as another name for Silk Typhoon, the group whose attacks Xu is accused of participating in.MURKY PANDAThe article identifies Murky Panda as another name for Silk Typhoon, the group whose attacks Xu is accused of participating in.Shanghai State Security Bureau (SSSB)The DOJ says Xu conducted cyberattacks on behalf of the SSSB, and court documents reportedly say he reported successful compromises to SSSB officers.Silk TyphoonThe article identifies Silk Typhoon as the APT group whose attacks Xu is accused of participating in.Xu ZeweiThe DOJ alleges that Xu conducted cyberattacks on behalf of China’s MSS and SSSB, including attacks on universities and researchers and exploitation of Microsoft Exchange Server vulnerabilities. He was extradited to the US and faces charges.Zhang YuNamed in the indictment alongside Xu Zewei and reported to remain at large; the article does not describe Zhang’s specific alleged activities.
Vendors
Products
Countries
ChinaXu, the DOJ says, conducted cyberattacks on behalf of China’s Ministry of State Security (MSS) and Shanghai State Security Bureau (SSSB), while working for Shanghai Powerock Network, a company known for supporting theUnited StatesA Chinese national accused of being part of a notorious state-sponsored advanced persistent threat (APT) group was extradited from Italy to the US over the weekend, the Department of Justice announced.