Counterintelligence & Tradecraft — 2026-05-05

FBI Secures Rare Extradition of MSS-Directed Silk Typhoon Hacker From Italy

The DOJ announced the extradition of Xu Zewei, a Chinese national arrested in Milan in 2025 at U.S. request, to face federal charges linked to Silk Typhoon cyberespionage operations. Court documents allege the MSS's Shanghai State Security Bureau directed Xu through Shanghai Powerock Network Co., Ltd., which prosecutors describe as one of several contractor firms used to conduct hacking on behalf of the Chinese government. Xu is accused of intrusions between February 2020 and June 2021 targeting COVID-19 research organizations and exploiting Microsoft Exchange Server zero-day vulnerabilities to deploy web shells and exfiltrate data from victim networks. He faces multiple counts of computer intrusion and conspiracy.

Analysis
The Shanghai Powerock indictment adds a documented instance of MSS operational tasking routed through nominally commercial fronts to preserve state deniability, and Italy's cooperation signals that U.S. diplomatic pressure is producing concrete enforcement outcomes beyond sealed charges. Per DOJ court documents with no independent corroboration, the case has moved from arrest to prosecutable record: nine counts filed, the contractor firm identified, the Exchange Server zero-day methodology exposed. Conviction within 12 months is unlikely; CIPA proceedings over classified attribution evidence and pretrial complexity typically push comparable cases to 18-36 months. The prosecution's framing and timing plausibly serve diplomatic signaling in U.S.-China technology competition at least as much as they advance a trial-ready case.
2 sources
  1. Alleged Silk Typhoon hacker extradited to US for cyberespionage - PRSOL:CC
  2. Prolific Chinese State-Sponsored Contract Hacker Extradited from Italy - DOJ US Attorney Southern District of Texas

View in full brief →

UNCLASSIFIED // OPEN SOURCE