Silk Typhoon (Threat actor): news timeline & CVEs

US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward

The US offers up to $10 million for alleged Hafnium hacker Zhang Yu, still at large.

The US State Department’s Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a Chinese national accused of participating in the Hafnium campaign against Microsoft Exchange. Zhang, described as a director at Shanghai Firetech, and Xu Zewei were charged in a nine-count indictment unsealed in July 2025; Xu was extradited from Italy in April 2026. Authorities say they stole US COVID-19 research in 2020 and later exploited Exchange flaws, with the FBI stating the campaign compromised more than 12,700 US organizations. Microsoft tracks Hafnium as Silk Typhoon.

SecurityWeek12:46 UTC · 9h agoPolicy & legal 6 sources

U.S. Offers $10 Million Reward for Alleged HAFNIUM Hacker Zhang Yu

The United States offered $10 million for Zhang Yu, accused of helping run the HAFNIUM Exchange intrusions.

The U.S. State Department’s Rewards for Justice program is offering up to $10 million for information leading to Zhang Yu, a director at Shanghai Firetech. Prosecutors allege he directed employees, including Xu Zewei, in operations for China’s Ministry of State Security in Shanghai, covering 2020 theft of U.S. COVID-19 research and the HAFNIUM intrusions against Microsoft Exchange Server. The FBI says that Exchange campaign compromised more than 12,700 U.S. organizations. Xu was arrested at Milan Malpensa Airport on July 3, 2025, and later extradited; Zhang remains at large and the charges are untested.

Security Affairsupdated 12:46 UTC · 9h agofirst 10:11 UTC · 12h agoPolicy & legal 6 sources

U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks

US State Department offers up to $10 million for tips locating Zhang Yu, Chinese national charged in HAFNIUM Microsoft Exchange hacks.

The State Department's Rewards for Justice program is offering up to $10 million for information identifying or locating Zhang Yu, charged in Houston federal court on nine counts for 2020-2021 intrusions including the HAFNIUM Microsoft Exchange campaign that compromised more than 12,700 US organizations. Zhang, allegedly a director at Shanghai Firetech working on tasks from the Shanghai State Security Bureau, remains at large; co-defendant Xu Zewei of Shanghai Powerock was arrested in Milan in July 2025 and extradited from Italy in April 2026. Microsoft disclosed the Exchange attacks on March 2, 2021, patched four zero-day flaws including ProxyLogon, and attributed them to the China-sponsored group it now tracks as Silk Typhoon. Earlier intrusions targeted US universities and COVID-19 vaccine researchers.

The Hacker Newsupdated 12:46 UTC · 9h agofirst 07:42 UTC · 15h agoPolicy & legal 6 sources1

New Dell System Update flaw lets hackers gain root privileges

Dell warns a critical System Update path-traversal flaw, CVE-2026-86360, lets unauthenticated attackers run code as root.

Dell warned that CVE-2026-86360, a critical path-traversal flaw in the Dell System Update CLI, lets an unauthenticated remote attacker access the filesystem and execute arbitrary code as root on unpatched systems. The same update fixes high-severity DSU bugs CVE-2026-63697 and CVE-2026-71168 for remote code execution and CVE-2026-86361 and CVE-2026-86362 for privilege escalation; customers should move to DSU 2.3.0.0 or later. Dell also urged immediate patching of maximum-severity Container Storage Modules flaws CVE-2026-63688 and CVE-2026-63692. Dell has not flagged these new issues as actively exploited.

BleepingComputerOct 5, 14:53 UTC · 3d agoVulnerability CVE-2026-86360 CVE-2026-63697 CVE-2026-71168+6 CVEs2

Dell asks admins to patch max severity CSM flaws as soon as possible

Dell patched six critical Container Storage Modules flaws that let unauthenticated attackers gain admin control of enterprise storage.

Dell patched six critical flaws in Container Storage Modules, which link PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT arrays to Kubernetes. CVE-2026-63688 and CVE-2026-63692, both missing-authentication bugs in CSM Authorization, let unauthenticated remote attackers steal storage admin credentials or bypass auth and take full administrative control, including across tenants. Four further flaws allow root on cluster nodes (CVE-2026-67269), admin access to the authorization proxy (CVE-2026-54472), forged admin tokens (CVE-2026-61421), and cluster-wide reads of Kubernetes Secrets (CVE-2026-67273). Dell urges an upgrade to version 1.18.0 or later and has not reported active exploitation of these bugs.

BleepingComputerOct 2, 12:37 UTC · 6d agoVulnerability CVE-2026-63688 CVE-2026-63692 CVE-2026-67269+5 CVEs1

MI5 Warns Over 100 Academics Helped China's Espionage Plans

MI5 warned that over 100 UK-linked academics unknowingly aided MSS espionage via projects funded through China's CGTRI/CAGT front organization.

MI5 issued a rare espionage alert on September 30 warning that more than 100 UK-linked academics contributed to projects funded by China's Ministry of State Security via the China General Technology Research Institute (CGTRI), also known as China Academy of General Technology (CAGT). Research topics included artificial intelligence, cybersecurity, covert communications systems, and steganography, which MI5 says directly improves MSS technical capability. The agency urged academic institutions to review collaborations, trace funding sources, and use RCAT and NPSA Trusted Research guidance, warning that violations could fall under sections 3 and 17 of the National Security Act 2023. The MSS has been linked to hacking groups such as Silk Typhoon and Salt Typhoon.

Infosecurity MagazineOct 1, 07:37 UTC · 7d agoThreat actor

Silk Typhoon

Timeline6 articles

Related CVEsby mentions

Appears with