Xu Zewei Extradited to U.S. to Face Charges Over Alleged HAFNIUM Intrusions
Summary
Xu Zewei was extradited from Italy to the U.S. to face charges alleging involvement in HAFNIUM and 2021 Microsoft Exchange intrusions. He denies the allegations and claims mistaken identity.
Key points
- Xu Zewei's lawyer confirmed he was extradited from Milan to the U.S.; he is being held at the Houston Federal Detention Center.
- A nine-count indictment alleges Xu participated in intrusions from February 2020 to June 2021, including the HAFNIUM campaign and 2021 Microsoft Exchange attacks.
- Prosecutors allege Xu acted at the direction of China's Ministry of State Security and Shanghai State Security Bureau.
- Court documents say the intrusions targeted U.S. universities and researchers working on COVID-19 vaccines, treatments, and testing.
- Xu denies involvement and says his arrest was a case of mistaken identity; he faces up to 77 years in prison if convicted.
- Co-defendant Zhang Yu remains at large.
Article Details
- Event Type
- Extradition to the United States of Xu Zewei, who is accused of involvement in state-directed cyber intrusions; he faces a nine-count indictment.
- Impact
- U.S. prosecutors allege the intrusions targeted universities and COVID-19 researchers to steal research, and that the HAFNIUM campaign compromised thousands of computers worldwide. FBI cyber division assistant director Brett Leatherman said HAFNIUM targeted over 60,000 U.S. entities and successfully victimized more than 12,700. Xu denies involvement and claims mistaken identity; the allegations have not been established in court.
People
Brett LeathermanFBI cyber division assistant director who said HAFNIUM targeted over 60,000 U.S. entities and victimized more than 12,700.Lin JianChinese Foreign Ministry spokesman who criticized Italy's decision to extradite Xu Zewei.Simona CandidoXu Zewei's lawyer; she confirmed to Recorded Future News that he had been extradited and was being held in Houston.
Threat Actors
HafniumU.S. prosecutors attribute intrusions, including a campaign that allegedly compromised thousands of computers worldwide and targeted U.S. universities and COVID-19 researchers, to HAFNIUM. The article says HAFNIUM is also known as Silk Typhoon.Silk TyphoonThe article identifies Silk Typhoon as another name for HAFNIUM, which U.S. prosecutors associate with the alleged intrusions and targeting described.Xu ZeweiU.S. prosecutors allege Xu participated in HAFNIUM intrusions and Microsoft Exchange attacks at the direction of Chinese security services. Xu denies involvement and claims mistaken identity; the allegations have not been established in court.Zhang YuNamed as Xu Zewei's alleged co-defendant and co-conspirator in the U.S. indictment; the article says Zhang remains at large. The alleged involvement has not been established in court.
Vendors
Products
Countries
Chinaparticipated in the HAFNIUM (aka Silk Typhoon) and Microsoft Exchange server attacks at the direction of China’s Ministry of State Security and Shanghai State Security Bureau, and he faces up to 77 years in prison ifItalyRead More: https://therecord.media/chinese-hacker-italy-extraditedUnited StatesXu Zewei, a Chinese national accused of belonging to a state-backed hacking group, was extradited from Milan to the U.S.