Cybersecurity Wrap-Up: Major Takedowns and Soaring Social Media Scams

In this week's cybersecurity roundup, we cover significant law enforcement victories against state-backed hackers and massive fraud networks, alongside alarming new data on social media scams. From the extradition of a Chinese intelligence contractor to the dismantling of a €50 million crypto fraud ring, and a stunning $2.1 billion loss to social media fraudsters, here are the key takeaways.

How did authorities dismantle a state-backed espionage ring this week?

Italian authorities extradited Xu Zewei, an alleged Chinese Ministry of State Security (MSS) contract hacker, to the U.S. to face federal cyberespionage charges. Operating with the Silk Typhoon group, Xu systematically compromised internet-facing systems between February 2020 and June 2021. The Department of Justice says the group targeted COVID-19 research organizations, stealing critical vaccine and treatment data by exploiting Microsoft Exchange Server zero-day vulnerabilities and deploying malicious web shells. Xu now faces multiple counts of computer intrusion and conspiracy in federal court.

What role did Xu Zewei and Silk Typhoon play in cyberespionage?

Xu Zewei acted as a contract hacker for the MSS, working alongside the Silk Typhoon group. Their coordinated campaign involved exploiting zero-day vulnerabilities in Microsoft Exchange Server to gain deep network access. Between February 2020 and June 2021, they relentlessly attacked COVID-19 research organizations, exfiltrating sensitive data on vaccines and treatments. The group used web shells to maintain persistent access, enabling long-term intelligence gathering. This case highlights the intersection of state-backed espionage and cybercrime.

How did European police dismantle a €50 million crypto fraud network?

European law enforcement took down a sophisticated cryptocurrency investment fraud ring that caused over €50 million in global losses. Operating like a legitimate business, the syndicate employed up to 450 individuals across call centers in Albania. They lured victims through online ads, then assigned retention agents who used intense pressure and remote access software to manipulate deposits. Illicit funds were channeled through international money-laundering pipelines to evade authorities.

What methods did the crypto fraud syndicate use to lure victims?

The syndicate used a multi-step approach: first, they lured vulnerable individuals via online advertisements promising high returns. Then, retention agents built trust and applied pressure through persistent calls and remote access software. Victims were tricked into making larger deposits, which were immediately funneled into money-laundering networks. The operation mimicked a legitimate enterprise, with specialized roles and even a customer support structure.

How did Evan Tangeman launder $230 million in stolen cryptocurrency?

Evan Tangeman received a nearly six-year prison sentence for laundering $230 million from a cryptocurrency heist between October 2023 and May 2025. Attackers initially breached a Washington D.C. victim by impersonating Gemini customer support, using remote desktop software to steal thousands of Bitcoin after bypassing two-factor authentication. Tangeman then obfuscated the proceeds through a network of cryptocurrency mixers, exchanges, and virtual private networks. The laundered funds financed a lavish lifestyle until his arrest.

What does the FTC's report reveal about social media fraud in 2025?

The U.S. Federal Trade Commission (FTC) reported that social media fraud losses exceeded $2.1 billion in 2025, an eightfold increase since 2020. Nearly 30% of all fraud victims were targeted via platforms like Facebook, Instagram, and WhatsApp. Notably, losses from Facebook-originated scams surpassed those from traditional text and email campaigns combined. The FTC warns that scammers exploit these platforms to reach all age demographics effectively.

Which social media platforms are most exploited by scammers?

According to the FTC, Facebook, Instagram, and WhatsApp are the most exploited platforms. Facebook emerged as the primary threat vector, with consumers losing more money to schemes originating there than to text and email scams combined. Instagram and WhatsApp are also heavily used for fraud, targeting younger users. The report emphasizes that social media has become the dominant channel for scammers due to its wide reach and ease of impersonation.

Why is Facebook cited as the primary threat vector for fraud?

Facebook's massive user base and advertising tools make it a prime platform for scammers. The FTC notes that losses from Facebook-based fraud exceeded those from all other communication channels combined. Scammers create fake profiles, run deceptive ads, and use Facebook Marketplace to lure victims. The platform's algorithms can also be exploited to target vulnerable users. This trend underscores the need for stronger platform accountability and user education.