Italy Moves to Extradite Chinese National to U.S. on Hacking Charges

Apr 27
2 min read

Key Findings

Italian authorities extradited Chinese national Xu Zewei to the U.S. on Monday after his arrest in Milan in July 2025
Xu is accused of being part of HAFNIUM (also known as Silk Typhoon), a state-backed hacking group directed by China's Ministry of State Security
The group targeted COVID-19 research at universities, exploiting Microsoft Exchange Server zero-day vulnerabilities to compromise over 12,700 U.S. organizations
Xu allegedly worked for Shanghai Powerock Network, a contractor conducting cyber operations on behalf of Chinese intelligence services
He faces up to 62 years in prison on charges including wire fraud, unauthorized computer access, and identity theft

Background

Xu Zewei, a 34-year-old Chinese national, was arrested at Milan's Malpensa Airport on July 3, 2025, after arriving on a flight from China. U.S. authorities had issued a warrant for his arrest on cyber-espionage charges. Italian police seized his documents and devices at the request of U.S. authorities. His extradition to the United States was formally completed on Saturday, with his first appearance in U.S. District Court for the Southern District of Texas occurring on Monday. He is currently being held at a federal prison in Houston.

The HAFNIUM Campaign

HAFNIUM conducted a sweeping espionage campaign during the height of the COVID-19 pandemic, targeting sensitive research and critical infrastructure. The group exploited multiple zero-day vulnerabilities in Microsoft Exchange Server starting in early 2020. Their victims included universities researching COVID-19 vaccines and treatments, infectious disease experts, law firms, defense contractors, and policy think tanks. The campaign compromised nearly 13,000 U.S. organizations, according to law enforcement. Microsoft first publicly warned customers about the attacks in March 2021, followed by a joint advisory from the FBI and the Cybersecurity and Infrastructure Security Agency.

Xu's Alleged Role

Xu allegedly worked under the direction of China's Ministry of State Security's Shanghai State Security Bureau to infiltrate U.S. networks, steal sensitive data, and install webshells for persistent remote access. His specific targets included research institutions working on COVID-19 vaccines, testing, and treatments during the initial pandemic wave. He is also accused of stealing information regarding U.S. policymakers and government agencies from a global law firm with offices in Washington. A co-conspirator, Zhang Yu, remains at large.

Defense Claims and Family Opposition

Xu's wife and legal team have maintained his innocence, claiming he is simply an IT technician. His wife stated that his valid Italian entry visa should prove they committed no crimes and expressed confusion about his arrest. Court records indicate Xu worked as an IT manager at Shanghai GTA Semiconductor Ltd developing systems and networks. His Italian attorney, Simona Candido, did not dispute the extradition but coordinated the legal process.

Broader Implications

The case demonstrates how cyber espionage increasingly operates through networks of private contractors working on behalf of state intelligence agencies. Law enforcement officials emphasized that Xu represents one of many contractors the Chinese government uses to obscure its involvement in cyber operations. His extradition from Italy underscores the importance of international cooperation and the vulnerability of nation-state actors when they travel to countries with U.S. extradition agreements. The case also highlights the ongoing challenge of preventing sophisticated state-sponsored attacks through better security practices, faster threat detection, stronger identity controls, and closer coordination between international allies.

Sources

https://securityaffairs.com/191368/apt/italy-moves-to-extradite-chinese-national-to-the-u-s-over-hacking-charges.html
https://cyberscoop.com/xu-zewei-extradited-china-national-silk-typhoon-hafnium/
https://therecord.media/chinese-hacker-italy-extradited
https://www.facebook.com/firstpostin/posts/italy-has-decided-to-extradite-a-chinese-national-xu-zewei-to-the-united-states-/1479564907537825/