China-linked hacker extradited to face charges over vaccine research theft

Italian authorities have extradited 34-year-old Chinese national Xu Zewei to the United States following his arrest in Milan. The transfer marks the culmination of an investigation by Italian police, who detained the suspect last July on suspicion of conducting cyberattacks against institutions engaged in COVID-related research.

US prosecutors allege that Xu, while employed at the Shanghai Powerock Network, executed the operations under the direction of China's Ministry of State Security. The campaign, dubbed "Hafnium", exploited cybersecurity flaws in email software to target thousands of computers, specifically focusing on universities and immunologists in Texas and Washington, DC to steal vaccine research during the pandemic.

Xu appeared in the US District Court in Houston on Monday to face nine criminal counts, including wire fraud and conspiracy to obtain information by unauthorised access to protected computers. Assistant Attorney General for National Security John A Eisenberg stated that the United States remains committed to pursuing hackers who steal information from US businesses and universities, noting that the investigation sought justice for years.

The potential penalty for the suspect is severe; if convicted, Xu could face up to 20 years in prison for each of the most serious charges brought against him. Prosecutors argue that the targeted institutions included a university in southern Texas and a law firm with offices in Washington, DC and worldwide.

Diplomatic responses to the allegations have been limited. The Chinese Embassy in Washington, DC, did not immediately respond to requests for comment, while Beijing has previously branded similar accusations as groundless smears. Xu's legal representatives in both Italy and the US, Simona Candido and Dan Cogdell, also declined to comment on the extradition proceedings.