Hacker Arrested: Cyber Espionage, SAP Flaws, and Scattered Spider - Oh My!

This is your Digital Frontline: Daily China Cyber Intel podcast. Digital Frontline: Daily China Cyber Intel and I’m Ting, here to make your digital life safer, smarter, and—let’s be honest—a heck of a lot more interesting. It’s July 8, 2025, and the cyber battlefield just got another plot twist. Buckle up listeners, because the U.S. Justice Department just made headlines: Xu Zewei, a prolific hacker working with China’s Ministry of State Security, was arrested in Milan after years of digital espionage. According to DOJ and Houston FBI, Xu is notorious for orchestrating cyberattacks against American institutions—especially targeting our COVID-19 immunologists and virologists during the pandemic. He wasn’t just poking around email; he exploited Microsoft Exchange Server vulnerabilities as part of the infamous HAFNIUM campaign and compromised thousands of systems globally. Xu worked with Shanghai Powerock Network Co. Ltd., a company long suspected of being a digital arm of Beijing’s intelligence apparatus. The University of Texas Medical Branch confirmed they were among the targets, and the Houston FBI isn’t done yet—Xu’s co-conspirator Zhang Yu is still out there. Let’s zoom out: this isn’t just about old breaches. Today’s threatscape is crackling with new sparks. Just released—SAP has patched a record number of security vulnerabilities, including a whopper: CVE-2025-30012, a deserialization flaw in SAP SRM with a perfect CVSS 10.0 score. It could allow unauthenticated attackers, likely including sophisticated China-nexus groups, to remotely take over critical procurement systems. If your org is still running SAP SRM, run, don’t walk, to patch that box. And while SAP Ariba is replacing SRM, that legacy window is wide open for anyone who hasn’t migrated. Meanwhile, in the wild, the notorious Scattered Spider group—often misattributed to China but now well known for international collaboration—continues targeting major U.S. firms using tools like Microsoft Active Directory and Okta. They love to trick IT help desks via “voice phishing” to bypass your multi-factor authentication, so don’t get complacent—train your staff, rotate those credentials, and monitor remote-access activity like a hawk. From an intel sweep this morning, certain U.S. supply chain and manufacturing sectors are seeing new phishing campaigns seeded from overlaps with PRC infrastructure. The biggest risk factors: unpatched SAP servers, lingering Microsoft Exchange vulnerabilities, and exposed admin portals for supplier management platforms. Here’s my rapid-fire toolkit for businesses and orgs who don’t want to be tomorrow’s headline. Patch your SAP and Microsoft systems—today, preferably before your morning cup of tea. Enforce access controls on all supplier and procurement platforms. Revisit help desk protocols—make “trust but verify” your mantra. And, for goodness’ sake, don’t recycle passwords across admin tools. Lastly, stay alert for fresh advisories from your security ven This content was created in partnership and with the help of Artificial Intelligence AI.