Chinese National Extradited to U.S. for Cyber Intrusions Linked to HAFNIUM and COVID-19 Research Theft A 34-year-old Chinese national, Xu Zewei (徐泽伟), was extradited to the U.S. over the weekend and appeared in federal court in Houston on a nine-count indictment for his role in state-sponsored cyber intrusions between February 2020 and June 2021. Xu, along with co-conspirator Zhang Yu (张宇), 44, is accused of participating in the HAFNIUM campaign a large-scale hacking operation that compromised thousands of systems worldwide, including U.S. organizations and targeting COVID-19 research during the pandemic. According to court documents, Xu’s activities were directed by officers of the PRC’s Ministry of State Security (MSS) Shanghai State Security Bureau (SSSB), China’s primary intelligence agency. At the time of the intrusions, Xu worked for Shanghai Powerock Network Co. Ltd., one of many Chinese "enabling" companies used by the PRC government to conduct cyber operations while obscuring its direct involvement. The indictment alleges that in early 2020, Xu and his co-conspirators hacked U.S. universities, immunologists, and virologists working on COVID-19 vaccines, treatments, and testing. On February 19, 2020, Xu confirmed to an SSSB officer that he had breached a Texas-based research university’s network. Days later, the officer instructed him to target specific email accounts belonging to researchers, which Xu later accessed and exfiltrated. From late 2020 into 2021, Xu and Zhang exploited vulnerabilities in Microsoft Exchange Server, a widely used email platform, as part of the HAFNIUM campaign. Microsoft publicly disclosed the state-sponsored attacks in March 2021, prompting the release of patches and detection tools. Despite mitigation efforts, hundreds of U.S. systems remained compromised. In April 2021, the U.S. Justice Department conducted a court-authorized operation to remove web shells installed by the hackers. By July 2021, the U.S. and its allies formally attributed the HAFNIUM campaign to the PRC’s MSS. Among the victims were a second Texas university and a global law firm, where Xu and Zhang installed web shells to maintain access and search for sensitive information. Their searches included terms like "Chinese sources," "MSS," and "HongKong," suggesting an interest in U.S. policy and intelligence-related data. The indictment highlights the PRC’s use of private contractors to conduct cyber espionage, allowing the government to distance itself from the operations. Xu faces charges including conspiracy to commit wire fraud, unauthorized access to protected computers, intentional damage to computer systems, and aggravated identity theft, with potential penalties totaling decades in prison. Zhang remains at large. The case is being investigated by the FBI’s Houston Field Office and prosecuted by the U.S. Attorney’s Office for the Southern District of Texas and the DOJ’s National Security Cyber Section. Xu’s extradition from Italy was secured with assistance from Italian law enforcement, including the Polizia Postale.