Xu Zewei, affiliated with the Chinese state-sponsored APT group Silk Typhoon (also known as Hafnium and Murky Panda), allegedly participated in cyberattacks targeting US universities and COVID-19 researchers between 2020 and 2021. These attacks involved exploiting zero-day vulnerabilities in Microsoft Exchange Server to gain remote access via web shells and exfiltrate sensitive data. Xu reportedly worked under direction from China's Ministry of State Security and Shanghai State Security Bureau while employed by Shanghai Powerock Network. The FBI intervened in 2021 to remove web shells from hundreds of compromised systems. Xu faces multiple federal charges in the US and has been extradited from Italy. Another individual named in the indictment remains at large.

The cyberattacks led to unauthorized access and data exfiltration from US universities and research institutions, particularly targeting COVID-19 related research. The exploitation of Microsoft Exchange Server zero-day vulnerabilities allowed attackers to deploy persistent web shells, enabling long-term remote access to compromised systems. This represents a significant breach of sensitive academic and research data, potentially impacting national security and intellectual property. The FBI's subsequent cleanup operation indicates the widespread nature of the compromise. Legal actions against Xu Zewei demonstrate US efforts to hold state-sponsored actors accountable.

There is no direct patch or remediation related to this threat actor's actions, as this is a law enforcement and attribution event rather than a software vulnerability. However, the FBI conducted a court-authorized operation to remove web shells from affected systems in 2021. Organizations should ensure Microsoft Exchange Server vulnerabilities are patched promptly and monitor for indicators of compromise related to web shells. Since this involves exploitation of known zero-day vulnerabilities that have since been addressed, applying official Microsoft security updates and following vendor guidance is critical. No additional mitigation is required specifically for this extradition event.