Loading story…
Italian authorities extradited Chinese national Xu Zewei to the United States over allegations that he took part in a Chinese state-backed hacking campaign linked to HAFNIUM, also tracked as Silk Typhoon. U.S. prosecutors say Xu and co-defendant Zhang Yu conducted intrusions between February 2020 and June 2021 on behalf of China’s Ministry of State Security and the Shanghai State Security Bureau, including efforts to steal COVID-19 vaccine and research data from U.S. universities and researchers. Xu was arrested at Milan’s Malpensa Airport on a U.S. warrant, later transferred to U.S. custody, and is now being held in Houston; he denies the allegations and claims mistaken identity.
The indictment also ties Xu to the mass exploitation of previously unknown Microsoft Exchange vulnerabilities that began in March 2021, a campaign U.S. authorities say hit more than 60,000 U.S. entities and successfully compromised over 12,700 organizations. Prosecutors allege the victims included defense contractors, law firms, think tanks, universities, and infectious disease researchers, making the case one of the most prominent efforts to bring an alleged Chinese state-linked hacker into U.S. custody. If convicted on all charges, Xu faces up to 77 years in prison.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
After being extradited from Italy, Xu Zewei made his first appearance in the U.S. District Court for the Southern District of Texas. The appearance followed the Justice Department's announcement of charges tied to the alleged HAFNIUM/Silk Typhoon espionage campaign.
By April 27, 2026, Xu Zewei had been extradited from Italy to the United States and was being held in Houston to face charges tied to the alleged China-backed hacking campaign.
Italian authorities initiated extradition proceedings to send Xu Zewei to the U.S. over cyber-espionage charges tied to the alleged 2020-2021 hacking campaign.
Italian authorities arrested Xu Zewei in July 2025 at Milan's Malpensa Airport on a U.S. warrant and seized his documents and devices.
According to the indictment, the charged hacking activity involving Xu Zewei and Zhang Yu ran from February 2020 until June 2021.
Beginning in March 2021, prosecutors say the operators attributed to HAFNIUM, later tracked as Silk Typhoon, exploited previously unknown Microsoft Exchange vulnerabilities in a broad campaign. The activity allegedly affected more than 60,000 U.S. entities and successfully compromised more than 12,700 organizations.
U.S. prosecutors allege that Xu Zewei and co-defendant Zhang Yu began intrusions in February 2020 against U.S. universities and researchers to steal COVID-19 vaccine and related research on behalf of Chinese state security services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
16 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcetheregister.com
Open sourcetheregister.com
Open sourcegovinfosecurity.com
Open sourcedatabreaches.net
Open sourcebleepingcomputer.com
Open sourcetechcrunch.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI’s **Operation Winter SHIELD** has been linked to the long-running response to the 2021 Microsoft Exchange exploitation campaign attributed to **HAFNIUM** (also tracked as **Silk Typhoon**), which expanded from targeted intrusions into a mass compromise of roughly **88,000** internet-facing servers worldwide. Researchers observed web shells implanted across organizations including utilities, government entities, managed service providers, and police departments, creating broad opportunities for follow-on exploitation by both the original operators and copycat actors. According to reporting on the case, the FBI—working with Department of Justice authorization under **Rule 41** and through a Unified Coordination Group—remotely removed malicious web shells from vulnerable Exchange servers as part of the disruption effort. The broader investigation later led to the **2025 arrest and extradition of alleged HAFNIUM co-conspirator Xu Zewei**, while U.S. authorities continued related cybercrime infrastructure takedowns in 2025 and 2026 targeting phishing, proxy, and bulletproof hosting services.
Aug 15, 2026
The FBI said it remotely removed **PlugX malware** from more than **4,200 U.S. computers** after obtaining court authorization to dismantle infrastructure tied to a long-running Chinese cyber campaign. The malware, commonly associated with Chinese state-backed operators, had infected mostly small office and home office devices, and the bureau deleted the malicious files without collecting personal data from victims. Reporting put the total at **4,258 systems**, underscoring the scale of the cleanup operation against a botnet that had quietly persisted on U.S. networks. U.S. authorities later expanded the crackdown by unsealing charges against **12 Chinese nationals** and seizing domains linked to a broader espionage and hacker-for-hire ecosystem associated with **Silk Typhoon** (also tracked as **APT27** and formerly **Hafnium**). Prosecutors alleged that China’s security services used contractors, including **i-Soon**, to hack U.S. government agencies and other prominent targets, charging state customers roughly **$10,000 to $75,000 per compromised email inbox** and tying the activity to intrusions spanning more than a decade, including the **U.S. Treasury** breach. Italian authorities subsequently arrested an alleged Silk Typhoon-linked suspect wanted over cyberespionage tied to COVID-19 vaccine research.
Jun 29, 2026
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Jun 29, 2026