U.S. authorities have extradited a Chinese national linked to the Silk Typhoon (Hafnium) espionage group, formally connecting the group to China’s Shanghai State Security Bureau and a commercial front company. The campaign targeted COVID-19 research institutions and exploited Microsoft Exchange Server zero-days between 2020 and 2021. Organizations that ran unpatched Exchange servers during that window should treat this as a confirmation of the threat actor’s capabilities and revisit historical logs for signs of compromise.