FBI Disrupted 88,000 Exchange Web Shells and Arrested Alleged HAFNIUM Co-Conspirator
Summary
A 2021 Microsoft Exchange campaign attributed to HAFNIUM compromised 88,000 servers. The FBI remotely removed web shells under a warrant, while alleged co-conspirator Xu Zewei was later arrested and extradited; the FBI also described broader infrastructure takedowns.
Key points
- Researchers linked the 2021 Exchange campaign to Chinese state-sponsored HAFNIUM, later known as Silk Typhoon, and identified 88,000 compromised servers.
- Huntress and other researchers coordinated victim notifications, but the effort could not reach victims quickly at that scale.
- Under a Rule 41 warrant, the FBI remotely removed malicious web shells from vulnerable servers, also disrupting access by copycat actors.
- Alleged HAFNIUM co-conspirator Xu Zewei was arrested in Milan in July 2025 and extradited to Houston to face charges.
- The FBI's Operation Riptide targets criminal infrastructure, including phishing platforms, residential proxy networks, and bulletproof hosting.
- The article says AI is accelerating vulnerability discovery and exploitation, with exposed edge devices among the expected targets.
Article Details
- Event Type
- FBI-led disruption of malicious web shells on compromised Microsoft Exchange servers, alongside the arrest and extradition of an alleged HAFNIUM co-conspirator and broader cybercrime infrastructure takedowns.
- Impact
- The 2021 Exchange attack affected approximately 88,000 servers worldwide. The FBI remotely removed malicious web shells under a Rule 41 warrant, disrupting access for the original actors and copycats. Xu Zewei was arrested in Milan in July 2025 and extradited to Houston to face charges. The article also reports Operation Riptide-related actions against phishing, residential proxy, and bulletproof-hosting infrastructure.
People
Threat Actors
Vendors
CrowdStrikearound the world. Huntress and a handful of other security researchers, including teams from CrowdStrike, split up the list and started calling organizations directly to warn them.Google3.87 million stolen credit cards, and roughly $1.9 billion in global losses. The FBI worked with Google and LumenTechnologies to take down its domains.HuntressIn 2021, a "limited and targeted" Microsoft Exchange attack turned out to be anything but. Huntress and a group of security vendors traced it to 88,000 compromised servers worldwide, tied to the Chinese state-sponsoredLumen Technologiestraffic through US residential IP space to disguise fraud and targeting was dismantled by the FBI, Lumen Technologies, and Google's Threat Intelligence Group.
Products
Countries
Industries
Financial ServicesGovernmentLaw enforcementown infrastructure. By working with a cloud hosting provider's privacy and legal teams, alongside law enforcement authorization, Huntress gained cloned access to the adversary's actual infrastructure, which is howManaged security servicesWater utilitiesThe victim list read like a cross-section of everyday infrastructure: water utilities, county governments, title and mortgage companies, MSSPs, and police departments around the world. Huntress and a handful of other