GoKawiilA Chinese national accused of carrying out cyberespionage operations for China's intelligence services has been extradited from Italy to the United States to face criminal charges.
According to a DOJ announcement, Xu Zewei is alleged to be a contract hacker for China's Ministry of State Security (MSS) who conducted breaches between February 2020 and June 2021 as part of a coordinated intelligence-gathering campaign.
Xu was previously arrested in Milan, Italy, in 2025 at the request of U.S. authorities for his alleged ties to the Silk Typhoon hacking group.
The indictment links Xu to a series of attacks attributed to the Chinese Silk Typhoon hacking group, also known as Hafnium, which exploited vulnerabilities in internet-facing systems to gain initial access to victim networks. Once inside, the attackers performed reconnaissance, deployed malware, and stole data.
The DOJ says Xu was involved in intrusions targeting COVID-19 research organizations, where the attackers allegedly sought to obtain data on vaccines, treatments, and testing.
U.S. authorities also allege that Xu and his co-conspirators exploited Microsoft Exchange Server zero-day vulnerabilities beginning in late 2020 as part of a widespread campaign to compromise email servers and gain access to victim networks.
After breaching vulnerable Exchange servers, attackers deployed web shells that allowed them to access mailboxes, move laterally within networks, and exfiltrate data. The widespread exploitation led to global incidents impacting thousands of organizations before patches were fully available.
Prosecutors say Xu and his co-defendant operated as contracted hackers under the direction of MSS officials.
"According to court documents, officers of the PRC's Ministry of State Security's (MSS) Shanghai State Security Bureau (SSSB) directed Xu to conduct this hacking," the DOJ said.
"When Xu conducted the computer intrusions, he allegedly worked for a company named Shanghai Powerock Network Co., Ltd. (Powerock)," the announcement adds, describing it as one of many firms used to carry out hacking operations on behalf of the Chinese government.
... continue reading