cyber.hendryadrian.com
Security News · bleepingcomputer.com

Alleged Silk Typhoon Hacker Xu Zewei Extradited to U.S.

· Original article ↗

Summary

Xu Zewei was extradited from Italy to the U.S. to face cyberespionage charges. Prosecutors allege he worked for China’s MSS and was linked to Silk Typhoon, exploiting Exchange vulnerabilities and using web shells to steal data.

Key points

  • Xu Zewei was extradited from Italy to the United States to face multiple charges related to computer intrusions and conspiracy.
  • U.S. prosecutors allege Xu worked as a contracted hacker under the direction of China’s Ministry of State Security.
  • The indictment links Xu to Silk Typhoon, also known as Hafnium, and alleges intrusions against COVID-19 research organizations.
  • Authorities allege Xu and co-conspirators exploited Microsoft Exchange Server zero-day vulnerabilities and deployed web shells to access mailboxes and exfiltrate data.
  • The charges concern alleged activity from February 2020 to June 2021; the allegations have not been established as facts in court.

Article Details

Event Type
Extradition to the United States of Xu Zewei, who is accused of cyberespionage and alleged involvement in intrusions linked to Silk Typhoon.
Impact
Prosecutors allege that Xu and co-conspirators exploited Microsoft Exchange Server zero-day vulnerabilities, deployed web shells, and stole data from victim networks, including COVID-19 research organizations. The article says the wider Exchange exploitation campaign affected thousands of organizations globally.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe indictment alleges exploitation of vulnerabilities in internet-facing systems, including Microsoft Exchange Server zero-days, to gain initial access.T1505.003 · Web ShellThe article says attackers deployed web shells on breached Exchange servers to access mailboxes and move within networks.

Threat Actors

HafniumThe article identifies Hafnium as another name for Silk Typhoon, which it links to intrusions exploiting vulnerabilities in internet-facing systems.Silk TyphoonThe indictment links Xu to intrusions attributed to this hacking group, which the article says exploited vulnerabilities in internet-facing systems.Xu ZeweiU.S. authorities accuse Xu of acting as a contracted hacker for China’s Ministry of State Security and participating in cyberespionage intrusions. The allegations have not been established as facts in the article.

Vendors

Microsoftprosecutors allege he exploited Microsoft Exchange zero-day vulnerabilities, deployed web shells to steal data from COVID-19 research organizations, and operated under cover companies such as Shanghai Powerock Network

Products

Microsoft Exchange Serverauthorities also allege that Xu and his co-conspirators exploited Microsoft Exchange Server zero-day vulnerabilities beginning in late 2020 as part of a widespread campaign to compromise email servers and gain access to

Countries

ChinaA Chinese national, Xu Zewei, accused of working as a contracted hacker for China’s Ministry of State Security and linked to the Silk Typhoon/Hafnium group, has been extradited from Italy to the United States to faceItalyChina’s Ministry of State Security and linked to the Silk Typhoon/Hafnium group, has been extradited from Italy to the United States to face charges for cyberespionage.United Statesof State Security and linked to the Silk Typhoon/Hafnium group, has been extradited from Italy to the United States to face charges for cyberespionage.

Related Articles