Italian authorities have extradited a Chinese national to the United States, where he faces charges of hacking into US government systems and research institutions involved in COVID-19 vaccine development. The extradition, confirmed by police on Monday, marks a significant step in transatlantic cooperation against state-sponsored cyber espionage.
The suspect, identified by the FBI as Xu Zewei, was arrested at Milan's Malpensa airport in July 2024. Italian police described him as a former head of a major technology company in Shanghai. He is accused of leading a hacking group known as "Hafnium," which allegedly exploited vulnerabilities in Microsoft Exchange Server software to infiltrate tens of thousands of email servers worldwide in 2021.
According to a statement from Italian police, the FBI alleges that Xu and his associates targeted US government entities, research institutes, and universities working on vaccine research during the peak of the pandemic in 2020 and 2021. The group is also accused of hacking a law firm and other entities. Microsoft previously described Hafnium as a "highly skilled and sophisticated actor."
Cooperation Between Rome and Washington
The extradition was executed under a warrant issued by a federal court in Texas. Italian police hailed the operation as a result of "excellent and well-established cooperation" with the FBI. Xu had been held in a prison in Busto Arsizio, near Milan, since his arrest.
In a court hearing, Xu pleaded not to be extradited, telling Judge Veronica Tallarida: "I am living the most difficult period of my life, I risk suffering an unfair trial in the USA and physical and psychological ill-treatment. Do not extradite me." His legal team has argued that the charges are politically motivated.
The case underscores the growing tensions between Western nations and China over cyber espionage, particularly during the pandemic. Italy's decision to extradite Xu aligns with broader European efforts to counter Chinese hacking activities, as seen in recent EU cybersecurity directives. For context, Beijing has previously warned of retaliation against EU industrial policies, highlighting the geopolitical stakes.
Xu now faces trial in the United States, where he could be sentenced to decades in prison if convicted. The extradition is a rare instance of a European country handing over a Chinese national accused of state-linked hacking to the US, reflecting the deepening security partnership between Rome and Washington.
