--- title: Five Years, 88,000 Backdoors, and a Pair of Handcuffs:... description: An inside look at the multi-year investigation into HAFNIUM/Silk Typhoon, the Chinese state-sponsored group behind the 2021 mass exploitation of on-premises... canonical: https://daily.dev/posts/five-years-88-000-backdoors-and-a-pair-of-handcuffs-inside-the-global-manhunt-that-ended-in-an-ar-pmnyy1hya twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest | daily.dev og:description: An inside look at the multi-year investigation into HAFNIUM/Silk Typhoon, the Chinese state-sponsored group behind the 2021 mass exploitation of on-premises... og:url: https://daily.dev/posts/five-years-88-000-backdoors-and-a-pair-of-handcuffs-inside-the-global-manhunt-that-ended-in-an-ar-pmnyy1hya og:image: https://api.daily.dev/og/posts/pMNyY1Hya.png og:image:alt: Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary An inside look at the multi-year investigation into HAFNIUM/Silk Typhoon, the Chinese state-sponsored group behind the 2021 mass exploitation of on-premises Microsoft Exchange servers that ultimately compromised over 80,000 organizations. Huntress researchers, working with a cloud provider and law enforcement, gained cloned access to the attackers' infrastructure and tracked the campaign in real time. The piece covers the shift from manual victim notification to a DOJ-authorized Rule 41 warrant letting the FBI remotely remove web shells at scale, the eventual arrest and extradition of alleged co-conspirator Xu Zewei, and the FBI's broader Operation Riptide campaign dismantling phishing platforms, proxy networks, and bulletproof hosting providers. It closes with FBI cyber crime statistics for 2025-2026 and commentary on how AI is accelerating both attacker reconnaissance and defensive prioritization. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Who was arrested for the 2021 Microsoft Exchange HAFNIUM/Silk Typhoon attacks? Xu Zewei, an alleged co-conspirator behind the HAFNIUM attacks who was also linked to targeting COVID-19 vaccine research for the Chinese Communist Party, was arrested in Milan in early July 2025 on a provisional warrant coordinated between the FBI and Italy's Polizia Postale. He was later extradited to Houston to face charges. _Security teams tracking nation-state threat actor takedowns can follow cases like this one on daily.dev._ ### How many organizations were affected by the 2021 Microsoft Exchange server mass exploitation attributed to HAFNIUM? More than 80,000 to 88,000 victim organizations were affected, including water utilities, county governments, title and mortgage companies, MSSPs, and police departments worldwide. The scale was uncovered after researchers gained cloned access to the attacker's infrastructure, revealing the incident had grown far beyond the initially assumed limited and targeted exploitation. _Anyone assessing exposure from large-scale server exploitation can dig deeper into incidents like this via daily.dev._ ### What legal mechanism did the FBI use to remove web shells from thousands of compromised Exchange servers without contacting each victim? The Department of Justice authorized one of the first uses of a Rule 41 search-and-seizure warrant of this kind, letting the FBI Houston Division remotely remove malicious web shells from vulnerable servers at scale with no individual victim outreach required. This followed five weeks of manual, largely unsuccessful phone-based victim notification. _Practitioners weighing incident response escalation paths can track precedents like this through daily.dev._ ## Similar posts on daily.dev - [FBI investigating breach that reportedly hit wiretapping net](https://daily.dev/posts/fbi-investigating-breach-that-reportedly-hit-wiretapping-net-hwrbcwlc6) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft) [View this post on daily.dev](https://daily.dev/posts/five-years-88-000-backdoors-and-a-pair-of-handcuffs-inside-the-global-manhunt-that-ended-in-an-ar-pmnyy1hya) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest","url":"https://daily.dev/posts/five-years-88-000-backdoors-and-a-pair-of-handcuffs-inside-the-global-manhunt-that-ended-in-an-ar-pmnyy1hya","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/five-years-88-000-backdoors-and-a-pair-of-handcuffs-inside-the-global-manhunt-that-ended-in-an-ar-pmnyy1hya"},"datePublished":"2026-08-18T16:16:32.410Z","dateModified":"2026-09-14T07:31:12.653Z","description":"An inside look at the multi-year investigation into HAFNIUM/Silk Typhoon, the Chinese state-sponsored group behind the 2021 mass exploitation of on-premises...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c94e5abbdc5633a95d56a34f12f1d183?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c94e5abbdc5633a95d56a34f12f1d183?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/five-years-88-000-backdoors-and-a-pair-of-handcuffs-inside-the-global-manhunt-that-ended-in-an-ar-pmnyy1hya","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/five-years-88-000-backdoors-and-a-pair-of-handcuffs-inside-the-global-manhunt-that-ended-in-an-ar-pmnyy1hya#faq","mainEntity":[{"@type":"Question","name":"Who was arrested for the 2021 Microsoft Exchange HAFNIUM/Silk Typhoon attacks?","acceptedAnswer":{"@type":"Answer","text":"Xu Zewei, an alleged co-conspirator behind the HAFNIUM attacks who was also linked to targeting COVID-19 vaccine research for the Chinese Communist Party, was arrested in Milan in early July 2025 on a provisional warrant coordinated between the FBI and Italy's Polizia Postale. He was later extradited to Houston to face charges. Security teams tracking nation-state threat actor takedowns can follow cases like this one on daily.dev."}},{"@type":"Question","name":"How many organizations were affected by the 2021 Microsoft Exchange server mass exploitation attributed to HAFNIUM?","acceptedAnswer":{"@type":"Answer","text":"More than 80,000 to 88,000 victim organizations were affected, including water utilities, county governments, title and mortgage companies, MSSPs, and police departments worldwide. The scale was uncovered after researchers gained cloned access to the attacker's infrastructure, revealing the incident had grown far beyond the initially assumed limited and targeted exploitation. Anyone assessing exposure from large-scale server exploitation can dig deeper into incidents like this via daily.dev."}},{"@type":"Question","name":"What legal mechanism did the FBI use to remove web shells from thousands of compromised Exchange servers without contacting each victim?","acceptedAnswer":{"@type":"Answer","text":"The Department of Justice authorized one of the first uses of a Rule 41 search-and-seizure warrant of this kind, letting the FBI Houston Division remotely remove malicious web shells from vulnerable servers at scale with no individual victim outreach required. This followed five weeks of manual, largely unsuccessful phone-based victim notification. Practitioners weighing incident response escalation paths can track precedents like this through daily.dev."}}]} ```