Italy Extradites to US a Chinese National Suspected of Hacking for Beijing

Prosecutors alleged that Xu Zewei was responsible for initial breaches of Microsoft Exchange servers that targeted thousands of computers worldwide.
Published: 4/28/2026, 4:01:48 AM EDT
Italy Extradites to US a Chinese National Suspected of Hacking for Beijing
A man types on a computer keyboard in front of the displayed cyber code in this illustration picture taken on March 1, 2017. (Kacper Pempel/Illustration/Reuters)

The Italian government has extradited to the United States a Chinese national who was accused of hacking into several U.S. universities to steal COVID-19 research and conducting cyberespionage on behalf of the Chinese communist regime.

In collaboration with FBI agents, Italian police arrested Chinese citizen Xu Zewei at Milan’s Malpensa Airport in July.

In an April 27 statement, Italian police stated that its International Police Cooperation Service had handed over “a dangerous foreign hacker” to U.S. authorities after completing the extradition process.

The U.S. Justice Department later confirmed that Xu, 34, appeared in court in Houston on April 27.

Xu, along with Zhang Yu, also a Chinese citizen, was charged in a nine-count indictment for his alleged involvement in computer intrusions between February 2020 and June 2021.

According to the indictment, Xu was a former manager at Shanghai Powerock Network, a Chinese tech company that U.S. authorities say engaged in cyber espionage under the direction of the Chinese Ministry of State Security’s Shanghai State Security Bureau.

Prosecutors alleged that Xu and Zhang, acting under the orders of the Chinese Ministry of State Security, hacked the computer systems of multiple U.S. universities, immunologists, and virologists to steal research related to COVID-19.

Prosecutors also alleged that Xu was involved with a Chinese state-sponsored hacking group responsible for the initial breaches of Microsoft Exchange servers starting in late 2020. The hacking operation, also known as Hafnium or Silk Typhoon, prompted the United States, the UK, and the European Union to issue their first joint statement condemning the Chinese state-backed cyber espionage, and the U.S. Justice Department to request a court order that would allow the FBI to remove malware from tens of thousands of civilian servers.

Xu denied the accusations when he appeared in an Italian court earlier this year, according to AFP.

The Epoch Times has reached out to his U.S.-based lawyer but didn’t receive a response by publication time.

At a press conference on April 27, Chinese Foreign Ministry spokesperson Lin Jian voiced the regime’s “strong dissatisfaction and opposition” to the decision to extradite Xu. 

Lin said that Beijing opposed “fabricating charges through political manipulation,” calling on Italy to “immediately correct its mistake,” according to a recording of the briefing. The ministry removed that exchange from the official transcript.

U.S. Assistant Attorney General for National Security John Eisenberg said U.S. prosecutors and investigators have sought justice in this case for years.

“The United States is committed to pursuing hackers who steal information from U.S. businesses and universities and threaten our cybersecurity,” Eisenberg said in a statement.

Brett Leatherman, an assistant director at the FBI’s cyber division, thanked Italian law enforcement for its efforts that led to Xu’s appearance in a U.S. courtroom to face charges.

“Xu will now answer for his alleged role in HAFNIUM, a group responsible for a vast intrusion campaign directed by China’s Ministry of State Security that compromised more than 12,700 U.S. organizations,” Leatherman said.

“He is one of many contractors the Chinese government uses to obscure its hand in cyber operations, and others who do the same face the same risk.”

John Marck, acting U.S. attorney for the Southern District of Texas, said the message his office sends today is the same as when the indictment was unsealed last year: “We will work to protect the American people.”

Frank Fang and Catherine Yang contributed to this report.