China-based hacker to face charges in US after arrest in Italy

An individual believed to be part of the notorious Chinese Hafnium hacking operation was arrested in Italy and is facing extradition to the United States.

At the request of the U.S., the Department of Justice said police in Milan apprehended Xu Zewei, a 33 year-old resident of the People’s Republic of China. Justice Department officials are seeking Xu's extradition to the United States for trial on hacking charges.

Xu is believed to be one of the key members of a Hafnium group that acted at the behest of the PRC in the early 2020s to target and left research and intellectual property from U.S. private research companies and public research institutions with the aim of securing valuable intellectual property (IP) for Beijing.

Most notably, the Hafnium group is believed to be responsible for a series of attacks in 2020 and 2021 targeting U.S. researchers and health providers during the peak of the COVID-19 global pandemic.

Xu and his colleagues are alleged to infiltrate those U.S. operations to steal intelligence and research, which was then sent back to PRC intelligence agencies.

Authorities believe that in some cases, Xu and other Hafnium members took their day-to-day marching orders and targets directly from agents with China’s SSRB intelligence operation. Xu, in particular, was said to have been directed by an agent to target email accounts at a specific research facility in Texas, which is where he is set to face trial.

“The indictment alleges that Xu was hacking and stealing crucial COVID-19 research at the behest of the Chinese government while that same government was simultaneously withholding information about the virus and its origins,” said U.S. Attorney Nicholas Ganjei.

“The Southern District of Texas has been waiting years to bring Xu to justice and that day is nearly at hand.”

Xu faces two counts of wire fraud, conspiracy to commit wire fraud, conspiracy to cause damage to and obtain information by unauthorized access to protected computers, and conspiracy to commit identity theft.

The arrest marks a rare occasion on which a Chinese national could actually face trial in the United States. As is often the case with state-sponsored operations, hackers who work with the Chinese government will often be identified and indicted for charges in the U.S., but will likely never face any realistic prospect of being arrested and hauled into an American court thanks to the protection offered by the state and its lack of extradition agreements.

By arresting Xu in Italy, the U.S. authorities have secured a rare change to bring a member of a Chinese state-sponsored hacking group before a judge.

More importantly, the resulting investigation and conversations with Xu could provide U.S. authorities, as well as security professionals and organizations, with valuable insight as to the inner-workings of Chinese state-backed hacking and espionage groups in regards to their tactics, structure, and approach to network intrusion.