Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Italy to Extradite Chinese Hacker Xu Zewei to US Over COVID‑19 Cyber Espionage

Part of the HAFNIUM story · since 24 Aug 2025

Quiet for 4 weekslast report 8 Oct10 articles5 outlets
24 Aug · Security Affairs first30 Mar12 Jun25 AugNowThis article4th of 10
  • Sun 24 Aug, 21:26 UTC. Security Affairs, first report. China-linked Silk Typhoon APT targets North America.
  • Tue 26 Aug, 23:15 UTC. BleepingComputer, its first report on the story. Silk Typhoon hackers hijack network captive portals in diplomat attacks.
  • Wed 27 Aug, 09:45 UTC. Security Affairs. China linked Silk Typhoon targeted diplomats by hijacking web traffic.
  • Mon 27 Apr, 09:21 UTC. Security Affairs. Italy to Extradite Chinese Hacker Xu Zewei to US Over COVID‑19 Cyber Espionage. This article, 4th of 10.
  • Mon 27 Apr, 23:50 UTC. DataBreaches, its first report on the story. Chinese hacker extradited from Italy to US for cyber espionage.
  • Tue 28 Apr, 09:31 UTC. The Hacker News, its first report on the story. Chinese Hacker Extradited to US Over COVID19 Vaccine Data Theft.
  • Tue 28 Apr, 13:47 UTC. SecurityWeek, its first report on the story. US extradites Chinese national over Typhoon university hacks.
  • Thu 8 Oct, 08:36 UTC. The Hacker News. US Offers $10 Million Reward for Suspected HAFNIUM Hacker.
  • Thu 8 Oct, 11:00 UTC. Security Affairs. US Offers $10 Million Reward for Alleged HAFNIUM Campaign Director.
  • Thu 8 Oct, 13:26 UTC. SecurityWeek. US Offers $10 Million Reward for Suspect in Microsoft Exchange Attacks.

Italy plans to extradite Xu Zewei to the United States over cyber-espionage charges, according to Bloomberg. The Chinese national—arrested in 2025 at Milan’s Malpensa Airport on a U.S. warrant—has been linked by Italian authorities to a China state-backed hacking ecosystem known as Hafnium, also called Silk Typhoon.

Prosecutors say he targeted universities and researchers working on COVID-19 vaccines, treatments, and testing between 2020 and 2021, with operations described as part of broader, politically motivated cyber intrusions. Xu Zewei’s case is framed as part of efforts to address espionage conducted under state auspices, while his family and wife have publicly opposed the extradition.

Italian police seized documents and devices in connection with the U.S. request, and the legal process is presented as part of a wider diplomatic and security approach to deter such cyber operations.

How the story developed

All 10 articles
Quiet for 4 weekslast report 8 Oct10 articles5 outlets

10 articles from 5 outlets since 24 Aug. Quiet since 8 Oct. This was the 4th report, 245 days after the first.

Now24 Aug23 Apr24 Oct11162127First reportSecurity Affairs · 24 Aug, 21:26This article4th of 10 · day 246
  • Sun 24 Aug, 21:26 UTC. Security Affairs, first report. China-linked Silk Typhoon APT targets North America.
  • Tue 26 Aug, 23:15 UTC. BleepingComputer, its first report on the story. Silk Typhoon hackers hijack network captive portals in diplomat attacks.
  • Wed 27 Aug, 09:45 UTC. Security Affairs. China linked Silk Typhoon targeted diplomats by hijacking web traffic.
  • Mon 27 Apr, 09:21 UTC. Security Affairs. Italy to Extradite Chinese Hacker Xu Zewei to US Over COVID‑19 Cyber Espionage. This article, 4th of 10.
  • Mon 27 Apr, 23:50 UTC. DataBreaches, its first report on the story. Chinese hacker extradited from Italy to US for cyber espionage.
  • Tue 28 Apr, 09:31 UTC. The Hacker News, its first report on the story. Chinese Hacker Extradited to US Over COVID19 Vaccine Data Theft.
  • Tue 28 Apr, 13:47 UTC. SecurityWeek, its first report on the story. US extradites Chinese national over Typhoon university hacks.
  • Thu 8 Oct, 08:36 UTC. The Hacker News. US Offers $10 Million Reward for Suspected HAFNIUM Hacker.
  • Thu 8 Oct, 11:00 UTC. Security Affairs. US Offers $10 Million Reward for Alleged HAFNIUM Campaign Director.
  • Thu 8 Oct, 13:26 UTC. SecurityWeek. US Offers $10 Million Reward for Suspect in Microsoft Exchange Attacks.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 10 articles as a list
  1. Sun 24 AugDay 01
    1. China-linked Silk Typhoon APT targets North America21:26 · Security Affairs · First report

  2. Quiet for 2 days

    Tue 26 AugDay 21
    1. Silk Typhoon hackers hijack network captive portals in diplomat attacks23:15 · BleepingComputer · Picked up again
  3. Wed 27 AugDay 31
    1. China linked Silk Typhoon targeted diplomats by hijacking web traffic09:45 · Security Affairs

  4. Quiet for 35 weeks

    Mon 27 AprDay 2462
    1. Italy to Extradite Chinese Hacker Xu Zewei to US Over COVID‑19 Cyber Espionage09:21 · Security Affairs · Picked up again · This article, 4th of 10
    2. Chinese hacker extradited from Italy to US for cyber espionage23:50 · DataBreaches
  5. Tue 28 AprDay 2472
    1. Chinese Hacker Extradited to US Over COVID19 Vaccine Data Theft09:31 · The Hacker News
    2. US extradites Chinese national over Typhoon university hacks13:47 · SecurityWeek

  6. Quiet for 23 weeks

    Thu 8 OctDay 4103
    1. US Offers $10 Million Reward for Suspected HAFNIUM Hacker08:36 · The Hacker News · Picked up again
    2. US Offers $10 Million Reward for Alleged HAFNIUM Campaign Director11:00 · Security Affairs
    3. US Offers $10 Million Reward for Suspect in Microsoft Exchange Attacks13:26 · SecurityWeek

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in