Italy Extradites Xu Zewei to US for COVID Cyberattacks

Italian authorities have extradited Chinese national Xu Zewei to the United States, where federal prosecutors accuse him of conducting cyberattacks on behalf of Chinese intelligence agencies to steal COVID-19 research from American universities and government entities between February 2020 and June 2021.

Xu, a former executive at a Shanghai technology company, was arrested on July 3 at Milan's Malpensa Airport while vacationing with his wife. Italian police acted on an arrest warrant issued by the U.S. District Court for the Southern District of Texas in November 2023. He had been detained near Milan since then, pending extradition, which U.S. officials confirmed occurred over the weekend. Xu is now held at the Houston Federal Detention Center.

According to a nine-count indictment, Xu and co-defendant Zhang Yu, who remains at large, belonged to a hacking group known as HAFNIUM, also called Silk Typhoon. The group exploited vulnerabilities in Microsoft Exchange Server software, compromising tens of thousands of servers worldwide, including over 60,000 U.S. entities and successfully breaching more than 12,700. Prosecutors allege the intrusions targeted U.S. government agencies, a...