U.S. Charges Extradited Xu Zewei Over Alleged HAFNIUM Espionage Campaign
Summary
Xu Zewei was extradited from Italy to the U.S. and charged over his alleged role in HAFNIUM/Silk Typhoon’s pandemic-era campaign, which officials say compromised more than 12,700 U.S. organizations.
Key points
- Xu was arrested in Milan at the United States’ request, extradited, and appeared in federal court in Texas.
- The indictment alleges Xu and co-conspirators exploited zero-day vulnerabilities in Microsoft Exchange Server to steal COVID-19 vaccine, treatment, and testing research.
- U.S. officials say the campaign was directed by China’s Ministry of State Security and compromised more than 12,700 U.S. organizations.
- The alleged targets included infectious disease experts, law firms, universities, defense contractors, think tanks, and government-related entities.
- Officials allege Xu stole data and implanted webshells for persistent remote access; the charges include computer intrusion, wire fraud, and identity theft.
- Xu faces up to 62 years in prison if convicted; co-defendant Zhang Yu remains at large.
Article Details
- Event Type
- Extradition to the United States and criminal charges against Xu Zewei for his alleged role in a pandemic-era cyber espionage campaign.
- Impact
- The campaign allegedly exploited zero-day vulnerabilities in Microsoft Exchange Server, compromised more than 12,700 U.S. organizations, stole COVID-19 vaccine, treatment, and testing research, and implanted webshells for persistent remote access. Targets also included infectious disease experts, law firms, universities, defense contractors, think tanks, and government-related entities. Xu faces charges carrying a potential sentence of up to 62 years; the allegations have not been established as fact in the article.
MITRE ATT&CK
People
Aaron ShrabergFlashpoint’s senior team lead of global intelligence commented on the law-enforcement action and the alleged state-led activity.Brett LeathermanThe FBI Cyber Division assistant director commented on the alleged campaign and its reported compromise of more than 12,700 U.S. organizations.John G.E. MarckThe acting U.S. attorney for the Southern District of Texas commented on the case and the effort to protect the public.Simona CandidoXu Zewei’s attorney in Italy provided information about the extradition timeline.
Threat Actors
HafniumThe article identifies HAFNIUM as the name of the espionage campaign in which Xu and co-conspirators allegedly participated.Silk TyphoonThe article describes Silk Typhoon as the more widely used name for the China state-sponsored threat group behind the attacks associated with the HAFNIUM campaign.Xu ZeweiAccused of exploiting Microsoft Exchange Server zero-days, stealing research and other data, and implanting webshells as part of the alleged campaign. He was extradited to the United States and charged; the allegations are not established as fact in the article.Zhang YuNamed as Xu Zewei’s co-defendant in the indictment and alleged to have participated in the campaign; the article says Zhang remains at large.
Vendors
Products
Countries
Chinavulnerabilities in Microsoft Exchange Server to steal COVID-19 research and conduct espionage directed by China’s intelligence services as part of the HAFNIUM/Silk Typhoon campaign.United StatesXu Zewei was extradited from Italy to the United States and formally charged for his alleged role in a massive pandemic-era intrusion campaign that compromised nearly 13,000 U.S.
Industries
DefenseThe campaign targeted infectious disease experts, law firms, universities, defense contractors, think tanks, and government-related entities.GovernmentThe campaign targeted infectious disease experts, law firms, universities, defense contractors, think tanks, and government-related entities.Think tanksThe campaign targeted infectious disease experts, law firms, universities, defense contractors, think tanks, and government-related entities.