Counterintelligence & Tradecraft — 2026-04-27

Italy Extradites Alleged Hafnium Hacker Xu Zewei to Face U.S. Espionage Charges

Xu Zewei arrived in U.S. federal custody in Houston on Saturday after Italy carried out a U.S. extradition request, confirmed by his Italian attorney Simona Candido and the Justice Department in an April 27 press release. Prosecutors allege he worked as a contractor for China's Ministry of State Security through Shanghai Powerock Network. Court filings charge him with participating in the 2021 Hafnium Exchange campaign that targeted more than 60,000 U.S. entities and compromised over 12,700, including defense contractors and infectious disease researchers. Xu appeared for his initial hearing in Houston on Monday and was remanded; the Financial Times reported the Chinese Foreign Ministry called the charges fabricated.

Analysis
The extradition establishes that Beijing's blanket refusal to surrender nationals cannot protect MSS contractor personnel who cross into cooperative third countries, a structural gap Italy's handover makes concrete. Corroborated across three outlets and confirmed by Xu's Italian counsel against a DOJ primary release, the Hafnium targeting scale places this among the most consequential cyber attribution cases DOJ has moved toward trial. MSS-affiliated contractor networks will likely impose stricter travel restrictions on personnel carrying indictment exposure within the next 12 months, though compliance inside China's opaque private-sector ecosystem will be externally unverifiable. Beijing's "fabricating cases" posture reflects a strategy of delegitimizing prosecutions to raise the political cost of future ones, not a genuine legal rebuttal. The indictment's attribution of core Hafnium activity to Xu's specific contractor role may outrun the forensic linkage available to prosecutors; his Italian presence could reflect personal travel entirely disconnected from active MSS tasking.
4 sources
  1. Hacker who allegedly carried out cyberattacks for China is extradited to U.S. - TechCrunch
  2. Justice Department Announces Arrest of Prolific Chinese State-Sponsored Contract Hacker - U.S. Department of Justice
  3. Italy extradites alleged Chinese hacker to US accused of spying for Beijing during COVID-19 pandemic - Euronews
  4. Chinese state-sponsored contract hacker arrested in Italy at U.S. request, DOJ says - NBC News

View in full brief →

UNCLASSIFIED // OPEN SOURCE