Loading story…
The FBI’s Operation Winter SHIELD has been linked to the long-running response to the 2021 Microsoft Exchange exploitation campaign attributed to HAFNIUM (also tracked as Silk Typhoon), which expanded from targeted intrusions into a mass compromise of roughly 88,000 internet-facing servers worldwide. Researchers observed web shells implanted across organizations including utilities, government entities, managed service providers, and police departments, creating broad opportunities for follow-on exploitation by both the original operators and copycat actors.
According to reporting on the case, the FBI—working with Department of Justice authorization under Rule 41 and through a Unified Coordination Group—remotely removed malicious web shells from vulnerable Exchange servers as part of the disruption effort. The broader investigation later led to the 2025 arrest and extradition of alleged HAFNIUM co-conspirator Xu Zewei, while U.S. authorities continued related cybercrime infrastructure takedowns in 2025 and 2026 targeting phishing, proxy, and bulletproof hosting services.
TTPs, infrastructure, and targeting history in one profile.
17 events from the most recent confirmed update back to the earliest known activity.
Through mid-June 2026, the FBI reported 87 arrests, 137 indictments, 145 disruptions, and 11 dismantlements. The figures were cited as current-year enforcement results.
Operation Riptide was described as an accelerated 60-day FBI campaign launched in June under Executive Order 14390 and the White House Cyber Strategy for America. The source frames it as part of intensified disruption efforts against cybercrime infrastructure.
The FBI stated that it completed at least a dozen extraditions of cyber actors in the first half of 2026. The source does not provide exact dates for the individual extradition actions.
Alleged HAFNIUM co-conspirator Xu Zewei was arrested in Milan in early July 2025 on a provisional warrant. The arrest was coordinated between the FBI and Italy's Polizia Postale.
The FBI reported that in 2025 its cyber teams made 197 arrests, secured 158 convictions, unsealed 345 indictments, conducted 261 disruptions, and completed 26 extraditions. These figures were presented as part of broader cybercrime enforcement activity.
The phishing-as-a-service platform Outsider was described as operating since 2023. It was later tied to more than 8,000 phishing domains, about 3.87 million stolen credit cards, and roughly $1.9 billion in global losses.
On July 19, 2021, the United States, the European Union, NATO, and other allied governments publicly accused China of malicious cyber activity and tied China's Ministry of State Security-linked hackers to the 2021 Microsoft Exchange server intrusion. The coordinated attribution marked a major multinational diplomatic condemnation of China's role in the campaign.
Microsoft announced a one-click mitigation tool for on-premises Exchange servers to help customers apply mitigations against the ongoing exploitation campaign. The tool was published as part of Microsoft's March 2021 response to the Exchange attacks.
Shadowserver reported that 21,248 Microsoft Exchange servers appeared compromised with a Babydraco web shell following exploitation of recently patched Exchange flaws. It also observed on March 26 attempts to install the backdoor at /owa/auth/babydraco.aspx and, on some hosts, a PowerShell script downloading a secondary payload from 159.65.136[.]128.
A Unified Coordination Group was convened through the U.S. National Security Council, and the Department of Justice authorized use of a Rule 41 warrant to support remote remediation. The FBI Houston Division then removed malicious web shells from vulnerable servers at scale to stop both the original intrusion set and copycat exploitation.
Huntress, CrowdStrike, and other security researchers split the victim list and directly contacted affected organizations, which included utilities, governments, MSSPs, and police departments. The effort showed that manual notification could not scale fast enough to the number of compromised organizations.
By gaining cloned access to adversary infrastructure with hosting-provider and law-enforcement coordination, Huntress confirmed the Exchange intrusion had grown far beyond limited targeting. Huntress tracked real-time logs across more than 80,000 victims, and the campaign resulted in about 88,000 backdoored servers worldwide.
Security researchers observed a wave of exploitation against on-premises Microsoft Exchange servers in 2021. The campaign was later attributed to the Chinese state-sponsored group HAFNIUM, also known as Silk Typhoon.
The FBI, Lumen Technologies, and Google's Threat Intelligence Group dismantled NetNut, a residential proxy platform used by foreign actors to route traffic through U.S. residential IP addresses. No explicit event date is given in the source.
The FBI worked with Google and Lumen Technologies to take down domains associated with the Outsider phishing-as-a-service platform. The source does not explicitly anchor the takedown to a specific date.
The FBI published a reference page for Operation Winter SHIELD. The provided material does not include operational details beyond the existence of the operation and its publication by the FBI.
After his arrest in Italy, Xu Zewei was extradited to Houston to face charges related to the HAFNIUM case. The source does not provide a specific date for the extradition.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
huntress.com
Open sourcefbi.gov
Open sourcewashingtonpost.com
Open sourcekrebsonsecurity.com
Open sourceshadowserver.org
Open sourcemsrc-blog.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Italian authorities extradited Chinese national **Xu Zewei** to the United States over allegations that he took part in a Chinese state-backed hacking campaign linked to **HAFNIUM**, also tracked as **Silk Typhoon**. U.S. prosecutors say Xu and co-defendant **Zhang Yu** conducted intrusions between February 2020 and June 2021 on behalf of China’s **Ministry of State Security** and the **Shanghai State Security Bureau**, including efforts to steal **COVID-19 vaccine and research data** from U.S. universities and researchers. Xu was arrested at Milan’s Malpensa Airport on a U.S. warrant, later transferred to U.S. custody, and is now being held in Houston; he denies the allegations and claims mistaken identity. The indictment also ties Xu to the mass exploitation of previously unknown **Microsoft Exchange** vulnerabilities that began in March 2021, a campaign U.S. authorities say hit more than **60,000** U.S. entities and successfully compromised over **12,700** organizations. Prosecutors allege the victims included defense contractors, law firms, think tanks, universities, and infectious disease researchers, making the case one of the most prominent efforts to bring an alleged Chinese state-linked hacker into U.S. custody. If convicted on all charges, Xu faces up to **77 years in prison**.
Jun 29, 2026
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026
Microsoft disclosed and patched four actively exploited on-premises Exchange Server vulnerabilities — `CVE-2021-26855`, `CVE-2021-26857`, `CVE-2021-26858`, and `CVE-2021-27065` — after investigators linked the initial intrusion wave to the China-linked **HAFNIUM** group. The flaws, later widely known as **ProxyLogon**, affected Exchange Server 2013, 2016, and 2019, with a defense-in-depth update also issued for Exchange 2010. Researchers said exploitation had begun by early January and rapidly expanded after public disclosure, with multiple threat actors using the bugs to gain remote access, drop **web shells** including **China Chopper** variants, steal email and files, dump credentials, and move laterally across victim networks. Security agencies and vendors warned that patching alone did not remove attacker access because many servers had already been backdoored, prompting urgent guidance to review Exchange `HttpProxy` and IIS logs, hunt for suspicious `w3wp.exe` child processes, PowerShell abuse, LSASS dumping, and unauthorized admin creation. The campaign hit organizations globally, including Norway’s parliament, and U.S. authorities later obtained court approval for an FBI operation that removed malicious web shells from hundreds of vulnerable U.S.-based Exchange servers. Microsoft, CISA, the FBI, and incident responders urged defenders to patch immediately, restrict exposure where possible, and conduct full compromise assessments because mass exploitation continued well beyond the initial disclosure.
Sep 3, 2026