Alleged Chinese State-Backed Hacker Extradited From Italy to US Over COVID-Era Cyber Espionage Case

An alleged Chinese cyber operative accused of participating in large-scale state-backed hacking campaigns has been extradited from Italy to the United States, marking a significant development in a long-running international cyber espionage investigation.

The accused, identified as Xu Zewei, is alleged by US authorities to have carried out cyberattacks on behalf of China’s state intelligence apparatus. Prosecutors claim he worked as a contractor linked to the Ministry of State Security, participating in coordinated cyber operations targeting sensitive research and critical infrastructure.

According to US Department of Justice allegations, Xu and co-conspirator Zhang Yu were involved in cyber intrusions targeting American universities in early 2020. These attacks reportedly focused on stealing research related to COVID-19 during the early stages of the global pandemic, when vaccine and medical research was considered highly sensitive and strategically valuable.

Authorities also allege that the group was responsible for exploiting vulnerabilities in Microsoft Exchange servers beginning in March 2021. These attacks were linked to large-scale breaches affecting thousands of email servers globally, later attributed to hacking clusters widely tracked under names such as Hafnium and Silk Typhoon.

Xu was initially arrested in Italy in 2025 and detained at a prison facility near Milan in Busto Arsizio while extradition proceedings were ongoing. After months of legal review, he was transferred to US custody over the weekend and is now reportedly being held in detention in Houston, Texas.

Court records indicate that his legal team is scheduled to appear in a Houston court hearing as proceedings begin to determine the next steps in the case. The extradition is expected to intensify diplomatic and cybersecurity tensions between Washington and Beijing, as cyber espionage remains a major point of friction between the two powers.

The case also highlights growing concerns over state-linked cyber operations targeting public health research, government systems, and enterprise infrastructure, particularly during global crises such as the COVID-19 pandemic.

US authorities maintain that the case is part of a broader effort to hold accountable individuals involved in state-sponsored cybercrime campaigns, while the accused has not yet been proven guilty in court.