Skip to content

Back to the catalog

Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest
huntress.comarticle

Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest

Huntress interview/recap covering the 2021 HAFNIUM (Silk Typhoon) mass exploitation of on-prem Microsoft Exchange servers that led to 88,000+ web shell backdoors, how Huntress and CrowdStrike tracked victims via cloned adversary infrastructure, and the FBI's unprecedented Rule 41 warrant used to remotely remove web shells at scale. It also details the July 2025 arrest of Xu Zewei, and 2026 FBI Operation Riptide takedowns of the Outsider phishing-as-a-service platform, NetNut residential proxy network, and MediaLand bulletproof hosting provider.

TL;DR Inside account of the HAFNIUM Exchange server mass-hack, the FBI's Rule 41 mass web-shell removal, and subsequent takedowns of phishing-as-a-service, proxy, and bulletproof hosting infrastructure.
Open original ↗

Organisations named here

  • FBI Cyber Division
  • Google Threat Intelligence Group
  • Operation Riptide
  • Rule 41
  • Silk Typhoon

Technologies named here

  • Huntress
  • Microsoft Exchange
  • CrowdStrike
  • Google
  • Lumen Technologies
  • Rule 41 search-and-seizure warrant

Techniques named here

  • Copycat scanning and exploitation
  • Phishing-as-a-service
  • Residential proxy traffic obfuscation
  • Bulletproof hosting
  • AI-accelerated vulnerability enumeration
  • Edge device targeting

Threat actors named here

  • HAFNIUM aka Silk Typhoon
  • Xu Zewei
  • Outsider
  • NetNut
  • MediaLand
  • Hafnium

Related in Threat Intel