A Chinese national accused of being part of a notorious state-sponsored advanced persistent threat (APT) group was extradited from Italy to the US over the weekend, the Department of Justice announced.
The individual, Xu Zewei, 34, was arrested in July 2025 after being charged in the US for participating in multiple cyberattacks mounted by Silk Typhoon (also known as Hafnium and Murky Panda), including attacks against US universities.
Xu, the DOJ says, conducted cyberattacks on behalf of China’s Ministry of State Security (MSS) and Shanghai State Security Bureau (SSSB), while working for Shanghai Powerock Network, a company known for supporting the country’s cyber offensive activities.
According to court documents, between early 2020 and early 2021, Xu and his co-conspirators targeted US universities, immunologists, and virologists conducting COVID‑19 research and reported successful compromises to SSSB officers.
After hacking into the network of a Texas university, Xu was directed to access the email accounts of virologists and immunologists, and he later reported to the SSSB officer that he exfiltrated information from the targeted inboxes.
Starting late 2020, Xu and his co-conspirators allegedly exploited Microsoft Exchange Server zero-day vulnerabilities in a broad campaign targeting thousands of systems worldwide, including computers at another Texas university, as well as a law firm with offices worldwide.
Following the successful exploitation of vulnerable Exchange servers, the hackers deployed web shells to achieve remote access. In April 2021, the FBI executed a court-authorized cyber operation to clean web shells from hundreds of systems in the US.
Xu appeared in a District Court in Houston this week. He is charged with nine counts of wire fraud, computer hacking, information theft, identity theft, and damaging protected computers, and faces many years in prison.
Another Chinese national named in the indictment, Zhang Yu, 44, remains at large.
Related: Report Links Chinese Companies to Tools Used by State-Sponsored Hackers
Related: Chinese Silk Typhoon Hackers Targeting Multiple Industries in North America
Related: Trump Administration Vows Crackdown on Chinese Companies ‘Exploiting’ AI Models Made in US
Related: Chinese Cybersecurity Firm’s AI Hacking Claims Draw Comparisons to Claude Mythos
