Prolific Chinese state-sponsored contract hacker extradited from Italy

HOUSTON - A 34-year-old citizen of the People’s Republic of China is set to appear in Houston federal court on a nine-count indictment related to his involvement in computer intrusions between February 2020 and June 2021. Xu Zewei (徐泽伟) was extradited April 25 and has now made his initial appearance in Houston federal court. He remains in custody pending a detention hearing set for April 30 at 10:30 a.m. before U.S. Magistrate Judge Richard W. Bennett. Certain of those computer intrusions allegedly are part of the HAFNIUM computer intrusion campaign that compromised thousands of computers worldwide, including in the United States. Other intrusions targeted U.S. COVID-19 research during the height of the pandemic. Xu is charged along with Zhang Yu (张宇), 44, who is also a PRC national. According to court documents, officers of the PRC’s Ministry of State Security’s Shanghai State Security Bureau directed Xu to conduct this hacking. The MSS and SSSB are PRC intelligence services responsible for PRC’s domestic counterintelligence, non-military foreign intelligence and aspects of the PRC’s political and domestic security, according to the charges. When Xu conducted the computer intrusions, he allegedly worked for a company named Shanghai Powerock Network Co. Ltd. Powerock was one of many “enabling” companies in the PRC that conducted hacking for the PRC government, according to the allegations. “Today, Xu Zewei will stand in a federal courtroom to answer for crimes that struck at the heart of American science and security — allegedly stealing COVID-19 research from our universities when the world needed it most,” said Acting U.S. Attorney John G.E. Marck for the Southern District of Texas. “We have pursued this moment across years and continents, and the message this office sends today is the same one we sent when we first unsealed this indictment: we will work to protect the American people.” “The United States is committed to pursuing hackers who steal information from U.S. businesses and universities and threaten our cybersecurity,” said Assistant Attorney General for National Security John A. Eisenberg. “I commend the prosecutors and investigators who have worked hard and sought justice for years in this investigation, and we look forward to proving our case in court.” “The extradition of Xu Zewei demonstrates the FBI's reach extends well beyond U.S. borders,” said Assistant Director Brett Leatherman of the FBI's Cyber Division. “Xu will now answer for his alleged role in HAFNIUM, a group responsible for a vast intrusion campaign directed by China's Ministry of State Security that compromised more than 12,700 U.S. organizations. He is one of many contractors the Chinese government uses to obscure its hand in cyber operations, and others who do the same face the same risk. The FBI thanks our Italian law enforcement colleagues, especially the Polizia Postale, whose partnership led to Xu's arrest in Milan and his extradition to the United States.” According to court documents, in early 2020, Xu and his co-conspirators hacked and otherwise targeted U.S.-based universities, immunologists and virologists conducting research into COVID‑19 vaccines, treatment and testing. Xu and others allegedly reported their activities to officers in the SSSB who were supervising and directing the hacking activities. For example, the charges alleges that on or about Feb. 19, 2020, Xu provided an SSSB officer with confirmation that he had compromised the network of a research university located in the Southern District of Texas. On or about Feb. 22, 2020, the SSSB officer directed Xu to target and access specific email accounts (mailboxes) belonging to virologists and immunologists engaged in COVID-19 research for the university, according to the indictment. Xu allegedly later confirmed for the SSSB officer that he acquired the contents of the researchers’ mailboxes. The charges further allege that beginning in late 2020, Xu and his co-conspirators ex