China-Linked Hacker Extradited to US Over COVID Research Theft

Xu Zewei, 34, is charged over alleged hacking operations between February 2020 and June 2021, including activity linked to the "HAFNIUM" campaign that compromised thousands of computers worldwide, including in the United States.

According to court documents, Xu acted under the direction of officers from the Shanghai State Security Bureau (SSSB), part of China's Ministry of State Security (MSS), which oversees foreign intelligence and counterintelligence operations.

"The United States is committed to pursuing hackers who steal information from US businesses and universities and threaten our cybersecurity," said Assistant Attorney General for National Security John A. Eisenberg.

Acting US Attorney John G.E. Marck said Xu would "stand in a federal courtroom to answer for crimes that struck at the heart of American science and security - allegedly stealing COVID-19 research from our universities when the world needed it most."

Prosecutors allege that Xu and his co-conspirators targeted US-based universities, immunologists and virologists working on COVID-19 vaccines, treatment and testing. In one instance in February 2020, Xu is said to have accessed a university network in Texas and later obtained the contents of researchers' email accounts at the direction of an SSSB officer.

The indictment states that Xu and Zhang Yu, a co-accused who remains at large, later exploited vulnerabilities in Microsoft Exchange Server systems as part of the HAFNIUM campaign.

"The extradition of Xu Zewei demonstrates the FBI's reach extends well beyond U.S. borders," said Brett Leatherman, Assistant Director of the FBI's Cyber Division.

He added that Xu was "one of many contractors the Chinese government uses to obscure its hand in cyber operations" and warned that others face similar risks.

Investigators said the HAFNIUM campaign exploited previously unknown vulnerabilities, enabling the installation of web shells that allowed remote access to compromised systems. Victims included universities and a global law firm, where stolen data was searched for information related to US policymakers and government agencies.

Court filings further allege that the conspirators used stolen credentials, malware and other techniques to maintain persistent access to victim networks, causing damage running into millions of dollars.

Xu faces multiple charges, including conspiracy to commit wire fraud, unauthorised access to protected computers, intentional damage to computer systems and aggravated identity theft. The most serious counts carry potential prison sentences of up to 20 years.

- IANS