The person at the center of this case
Sophos firewall users and affected organizations (approximately 81,000 firewalls compromised)
Cold Case · Open
229 days waiting
GUAN TIANFENG
Justice for Sophos firewall users and affected organizations (approximately 81,000 firewalls compromised) — the trail went cold in 2026, but the truth hasn't.
Start here
Key leads to think about
🎯
suspect
Lead #1Why is Guan Tianfeng believed to be in Sichuan Province, and what extradition efforts have been pursued with China?
🔍
evidence
Lead #2What specific zero-day vulnerability was exploited, and has it been patched across all affected Sophos firewall installations?
💡
clue
Lead #3What are the connections between Guan Tianfeng and Bangkok, Thailand, and could he be using it as a transit point?
Guan Tianfeng is wanted by the FBI for allegedly developing and testing a zero-day vulnerability used to compromise approximately 81,000 Sophos firewalls without authorization, enabling data theft from both the firewalls and connected computers. He is believed to be residing in Sichuan Province, China, with known ties to Bangkok, Thailand, and remains at large. The case involves complex cybercrime conspiracy charges that continue to impact global cybersecurity infrastructure.
Case
#913
United States District Court, Northern District of Indiana, Hammond Division; FBI
Try asking
Claim this imported case
A one-time $10 claim transfers this imported case workspace to your account. You get 10 uploads for this case, 25 daily AI questions for this case, and public tips with files route to you.
10 uploads25 AI questions/day
This does not start a subscription. When the included limits are reached, the Personal plan unlocks more workspace capacity.
More leads to consider
Beyond the top three above — each detail below could be the thread that pulls this case open.
👤
person
Lead #4Who were Guan Tianfeng's co-conspirators in this alleged computer fraud scheme?
⏰
timeline
Lead #5When was the vulnerability first developed and deployed, and over what timeframe were the 81,000 firewalls compromised?
Have information about any of these leads?
Even the smallest detail could be the key to solving this case.
Official wording
Source Narrative
Conspiracy to Commit Computer Fraud; Conspiracy to Commit Wire Fraud Caution: Guan Tianfeng is wanted for his alleged role in conspiring to access Sophos firewalls without authorization, cause damage to them, and retrieve and exfiltrate data from both the firewalls themselves and the computers behind these firewalls. The exploit was used to infiltrate approximately 81,000 firewalls.
It is alleged that Guan Tianfeng's role in the conspiracy was to develop and test the zero-day vulnerability used to conduct the attack. A federal arrest warrant was issued for Guan Tianfeng in the United States District Court, Northern District of Indiana, Hammond Division, after he was charged with conspiracy to commit computer fraud and conspiracy to commit wire fraud.
Remarks: It is believed that Guan Tianfeng is currently residing in Sichuan Province, China. He also has ties to or may visit Bangkok, Thailand.
Timeline of Events
🕵️
Unknown
Zero-day vulnerability exploitation
Guan Tianfeng allegedly developed and tested a zero-day vulnerability used to access Sophos firewalls without authorization and exfiltrate data from approximately 81,000 firewalls and connected computers.
📋
Unknown
Federal arrest warrant issued
A federal arrest warrant was issued in the United States District Court, Northern District of Indiana, Hammond Division for conspiracy to commit computer fraud and conspiracy to commit wire fraud.
Key Locations
Interactive map showing important locations related to this case
Case Information
Incident:Invalid Date
Last Updated:October 29, 2026
Up to $10 Reward
For information leading to the resolution of this case
Leave a comment
Comments
Case Information
Incident:Invalid Date
Last Updated:October 29, 2026
Up to $10 Reward
For information leading to the resolution of this case