Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest

This report summarizes the HAFNIUM (Silk Typhoon) Microsoft Exchange exploitation campaign that expanded from a presumed limited operation into a global incident with ~88,000 compromised servers using web shells; it covers real-time detection by Huntress and partners, a coordinated FBI-led remediation using Rule 41 warrants, an arrest and extradition of an alleged co-conspirator, and broader FBI efforts to dismantle criminal infrastructure and respond to AI-accelerated attacks.