Xu Zewei extradited to U.S. on cyberattack charges

Xu Zewei, who is accused of carrying out cyberattacks on behalf of the Chinese government, has been extradited—the transfer of a person from one jurisdiction to another—to the United States from Italy. If convicted, Xu faces over a decade in prison. His Italian defense attorney, Simona Candido, stated that Xu was extradited on Saturday.

According to the U.S. Justice Department, Xu allegedly worked as a contractor for the Chinese Ministry of State Security. Prosecutors alleged that Xu and co-conspirator Zhang Yu targeted U.S. universities in early 2020 to steal research related to the COVID-19 pandemic. The two also allegedly hacked thousands of email servers running Microsoft Exchange, an email server software, beginning in March 2021. This activity was described as part of an “indiscriminate” campaign attributed to Hafnium, a hacking group.

According to prosecutors, Xu allegedly worked for Shanghai Powerock Network, a company in China accused of conducting hacking for the Chinese government. Xu and other hackers allegedly reported their activities directly to Chinese state officials in Shanghai. Along with Zhang, Xu was part of the Hafnium group that allegedly took advantage of previously undiscovered security flaws in Microsoft Exchange servers. According to prosecutors, Hafnium hackers targeted more than 60,000 entities in the United States, successfully hacking more than 12,700 of them. The targeted organizations included defense contractors, think tanks, and infectious disease researchers.

Xu appeared in federal court for a hearing on Monday morning, where his U.S. defense attorney, Dan Cogdell, stated that Xu pleaded not guilty to all charges. Meanwhile, the Financial Times reported that the Chinese Foreign Ministry accused the U.S. government of “fabricating cases.” The prosecution follows previous U.S. efforts to target hacking crimes, such as the 2022 sentencing of Chinese intelligence officer Yanjun Xu to 20 years in prison after he was extradited to the United States.

Why it matters

The extradition of Xu Zewei marks a significant development in the U.S. government’s ongoing efforts to prosecute suspected Chinese hackers, following previous high-profile cases involving Chinese intelligence officers.