The extradition of Xu Zewei, an alleged contractor for China’s Ministry of State Security linked to the Silk Typhoon (Hafnium) APT group, marks a rare legal action against a state-affiliated cyber operator. The underlying campaign exploited Microsoft Exchange Server zero-days between February 2020 and June 2021, targeting defense contractors, COVID-19 researchers, law firms, and infectious disease institutions. This case reinforces that MSS operations rely on contractor fronts to maintain deniability, and that organizations running unpatched Exchange infrastructure remain a preferred vector for state-sponsored espionage.