Italian Police Arrest Alleged Chinese Hacker Wanted by FBI

Italian police arrested a Chinese national accused of facilitating Beijing-backed nation-state hack attacks. The man, Xu Zewei, faces criminal charges in the United States.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Acting on a U.S. arrest warrant issued as part of an FBI investigation, Italian police arrested Xu Zewei, 33, resident of Shanghai, when he arrived last week at Milan’s Malpensa airport, reported Italian newswire Ansa on Monday.

Xu is wanted by the FBI for working with a team of hackers tasked with conducting cyberespionage operations, including against researchers at the University of Texas who were developing novel coronavirus vaccines in 2020, Ansa reported (see: Chinese, North Korean Nation-State Groups Target Health Data).

He faces a nine count U.S. federal indictment, along with a co-defendant identified as Zhang Yu. The indictment alleges the Shanghai branch of the Ministry of State Security tasked Xu and Zhang with hacking vaccine research from February 2020 to June 2021. Zhang is at large.*

An Italian interior ministry document, cited by Ansa, said Xu is accused of participating in a “large-scale cyber intrusion campaign” tied to a Chinese-backed advanced persistent threat group tracked as Silk Typhoon that “targeted thousands of computers around the world” to obtain information on “various U.S. government policies.”

Charges include conspiracy, wire fraud, obtaining information by unauthorized access and intentional damage to a protected computer. Prosecutors say Xu faces the prospect of more than six decades in prison.

Enrico Giarda, the Italian lawyer who’s representing Xu, didn’t immediately respond to a request for comment. Xu is due to appear Tuesday at Milan’s Court of Appeals, where a U.S. extradition request will be heard, Ansa reported.

The indictment identifies Xu during his coronavirus research hacking spree as general manager of Shanghai Powerock Network. The Chinese government has cultivated a market of private sector contractors who take commissions from intelligence agencies to hack targets – but who also hack on spec in the hopes of later selling access or stolen data to the government. The indictment says Yu was a director of another company, Shanghai Firetech Information Science and Technology.

The two hackers exploited vulnerabilities in Microsoft Exchange. One signature of their activity was deployment of web shells with file names such as errorEEE.aspx. Microsoft disclosed the hacking campaign in March 2021, attributing it to Silk Typhoon, for which the computing giant then used the moniker “Hafnium.”

Microsoft published patches for the four Exchange zero-days allegedly exploited by Xu and Zhang that same month.

The apparent Xu and Zhang Exchange hacking campaign earned a rare advisory from the White House press briefing room, when White House press secretary Jen Psaki told network operators that they should “consider whether they have already been compromised and should immediately take appropriate steps.”

Among the known victims of that spree was white shoe law firm Covington & Burlington. Chinese hackers made off with details regarding nearly 300 of the firm’s clients. In subsequent litigation, Covington & Burlington characterized the hack as “directed at a small group of lawyers and advisors, and principally focused on state espionage to learn about policy issues of specific interest to China in light of the incoming Biden administration.” The indictment doesn’t identify Covington & Burlington, referring instead to a “law firm” victim.

A Plethora of Chinese Hacking Groups

The threat group with which Xu allegedly collaborated is also variously tracked as APT27, Emissary Panda and UNC5221, as well as Silk Typhoon, with “Typhoon” being Microsoft’s current codename for nation-state groups it attributes to China. Hackers associated with the threat group were behind a late 2024 incursion into Department of Treasury offices responsible for enforcing sanctions and conducting national security reviews of foreign investments in the U.S. economy.

Silk Typhoon “is an espionage-focused Chinese state actor whose activities indicate that they are a well-resourced and technically efficient group with the ability to quickly operationalize exploits for zero-day vulnerabilities in edge devices” and software, Microsoft’s Threat Intelligence group said earlier this year (see: China’s Silk Typhoon Tied to Cloud Service Provider Hacks).

Frequent Silk Typhoon tactics include exploiting zero-day and known vulnerabilities to gain access to targeted organizations, as well as dropping a lightweight backdoor known as the China Chopper to maintain remote access to an infiltrated network.

Xu’s arrest follows U.S. federal authorities unsealing indictments in March against two Chinese nationals – Zhou Shuai, aka “Coldface,” and Yin Kecheng – charging them with Silk Typhoon activity. Both men were previously indicted on multiple criminal counts, and have been accused of hacking into a “multinational conglomerate company” as well as stealing designs for electro-magnetic weapons and naval warships (see: US Seizes Chinese Hacker Infrastructure, Unseals Indictments).

Silk Typhoon is only one cluster of threat activity tied to the Chinese government and at least partially facilitated by the use of private hacking-for-hire firms.

Other major Chinese nation-state groups include Salt Typhoon, tied to the mass hacking of major telecommunications networks in the U.S. and dozens of other countries (see: Unpatched Cisco Devices Still Getting Popped by Salt Typhoon).

Another major group is tracked as Volt Typhoon, which has conducted mass exploits of privately owned routers to infiltrate American critical infrastructure. Security experts see the group as posing a military threat, since its efforts could be used to cause widespread disruption and chaos in targeted network, for example to try and slow any Western response to a Chinese invasion of Taiwan.

The Chinese APT group tracked as Flax Typhoon regularly launches information-theft and espionage operations against organizations in Taiwan. The group’s campaigns have included building a botnet based on the Mirai malware, comprised of over 200,000 consumer devices – including routers and digital video cameras – located in the U.S. and across the globe.

*Update July 8, 2025, 19:54 UTC: Adds reporting about the U.S. federal indictment.