China’s Pandemic Spy: Silk Typhoon Hacker Xu Zewei Extradited to US After Stealing COVID-19 Vaccine Research

In the spring of 2020, while virologists and immunologists at American universities were working around the clock to understand a novel coronavirus that had already killed tens of thousands of people, someone was reading their emails. Not a colleague. Not a peer reviewer. An agent of the Chinese government, directed by the Shanghai State Security Bureau to acquire the contents of researchers’ inboxes and forward them to handlers in Beijing.

That person, according to the US Department of Justice, was Xu Zewei.

On April 27, 2026, Xu — a 34-year-old Chinese national — appeared in US District Court in Houston, Texas, after being extradited from Milan, Italy. He faces a nine-count federal indictment covering wire fraud, unauthorized computer access, intentional computer damage, and aggravated identity theft. The charges carry a combined maximum sentence of 62 years in prison. The full DOJ press release was published the same day he set foot in a Houston courtroom.

It has taken six years to get him there. The wait illustrates exactly how difficult accountability for Chinese state-sponsored hacking actually is — and why this case is more significant than the charges alone suggest.

Who Is Xu Zewei

Xu is not a uniformed officer of the People’s Liberation Army or a salaried employee of the MSS. He is, according to prosecutors, a contract hacker — part of the sprawling ecosystem of private technical talent that China’s intelligence services use to conduct cyber operations at arm’s length. This is the model Silk Typhoon operates under. The group, originally designated Hafnium by Microsoft when it first publicly named the threat actor in March 2021, is believed to be directed by China’s Ministry of State Security and draws on contractors and affiliated criminal talent rather than keeping all operations in-house.

The use of contractors creates plausible deniability for the state and gives intelligence services surge capacity that a permanent employee roster cannot provide. It also, as the Xu case demonstrates, creates operational security risks: contractors move, travel, take vacations in countries that have extradition treaties with the United States.

Xu’s alleged co-conspirator is Zhang Yu, 44, also a Chinese national. Zhang was charged alongside Xu when the indictment was first unsealed in 2025. Zhang’s current whereabouts are unknown to US authorities in any actionable sense. He is almost certainly in China, where he is beyond the reach of US law enforcement absent the kind of diplomatic agreement that does not exist between Washington and Beijing on extradition.

The COVID Research Operation

The timeline the indictment describes runs from February 2020 through June 2021 — a period that begins in the first weeks of what would become a global pandemic and ends roughly when vaccine rollouts in the United States were already underway.

The Shanghai State Security Bureau, according to prosecutors, directed Xu to identify and target specific email accounts belonging to virologists and immunologists at US universities who were engaged in COVID-19 research. The research covered vaccines, treatment protocols, and testing methods — exactly the categories of scientific intelligence that a government managing its own pandemic response would want. Xu allegedly confirmed to his MSS handlers that he had successfully acquired the contents of targeted researchers’ mailboxes.

The operational picture this describes is precise rather than indiscriminate. The SSB wasn’t asking Xu to vacuum up everything reachable. They were asking for specific scientists, specific research, specific inboxes. That level of targeting implies the MSS had already identified the individuals whose work it wanted — through open-source monitoring of academic publications, conference proceedings, or prior intelligence — and was using Xu to execute the collection phase.

The human dimension of this operation is worth being explicit about. The researchers Xu allegedly targeted were not defense contractors or government officials. They were scientists, many of them at universities, working on one of the defining public health emergencies of the century. The data they were generating had direct implications for how quickly effective vaccines could be developed, tested, and distributed. Stealing that research did not help China fight COVID-19 faster in any legitimate sense. It handed the MSS a look at what American scientists knew, when they knew it, and where the leading edges of vaccine development were — intelligence that could inform everything from domestic policy decisions to disinformation campaigns.

The Hafnium Microsoft Exchange Campaign

The second strand of the indictment covers March 2021 and the mass exploitation of Microsoft Exchange Server vulnerabilities attributed to Hafnium — the same group Xu is alleged to have worked for.

The ProxyLogon vulnerabilities, as they became known, were a cluster of zero-day flaws in Microsoft Exchange that Hafnium had been exploiting for months before Microsoft published patches on March 2, 2021. Within days of that disclosure, exploitation went from targeted and surgical to indiscriminate: other threat actors piled in, automated scanning tools spread across the internet, and organizations worldwide scrambled to patch servers they sometimes didn’t even know they were running.

By the time the dust settled, more than 60,000 entities in the United States had been targeted. More than 12,700 had been successfully compromised. The Biden administration attributed the campaign to the PRC in July 2021, in a coordinated international statement joined by the EU, UK, NATO, and Australia — one of the most significant multilateral attributions of state-sponsored cyber activity ever organized.

Xu allegedly participated in this campaign. His specific role within the broader mass exploitation operation is not detailed in public charging documents, but his name appears in an indictment that prosecutors describe as covering an “indiscriminate” campaign — meaning the Exchange exploitation phase, unlike the COVID research theft, was not about specific targets. It was about access at scale.

The Extradition: Why Italy, Why Now

Xu was arrested in Milan in July 2025. The arrest followed a US extradition request and took place roughly four years after the criminal activity the indictment describes. The gap between offense and arrest is not unusual in complex cyber cases — building an indictment that can survive judicial scrutiny, identifying the suspect’s location, coordinating with a foreign law enforcement partner, and navigating the legal procedures of that partner’s judicial system takes years even under favorable conditions.

Italy’s cooperation is significant. The US and Italy have an extradition treaty, and Italian courts ultimately approved the transfer. That process took approximately nine months from arrest in Milan to courtroom in Houston — a relatively compressed timeline for international extradition, reflecting either the strength of the US evidentiary package or Italian judicial efficiency, or both.

China’s response to this kind of case is consistent and predictable: Beijing will not extradite its own citizens, denies that MSS-linked hacking groups exist as described, and treats indictments of Chinese nationals by US prosecutors as politically motivated. None of that changes the legal outcome for Xu, who made the mistake of leaving China and traveling to a country willing to act on a US extradition request.

Zhang Yu, his co-conspirator, made a different choice. He has not left China, or has not been found outside it. The indictment remains open against him. It will likely remain open indefinitely.

What This Means for Chinese Hacking Accountability

Cases like Xu’s are genuinely rare. The US government indicts Chinese state-sponsored hackers with some regularity — Volt Typhoon, APT40, APT41, Silk Typhoon, Salt Typhoon — and the vast majority of those indictments are effectively symbolic. They name individuals who are in China and will never appear in an American courtroom. They serve as public attribution, as diplomatic signals, and as legal records, but not as prosecutions in any functional sense.

Xu’s case is different because he was physically present in a country with an extradition treaty and the willingness to use it. That combination is rare for suspected Chinese intelligence contractors, who are generally advised — or have the good sense — to avoid travel to such countries.

The outcome matters beyond the individual case. It demonstrates that the legal infrastructure around Chinese cyber accountability is not entirely theoretical — that indictments can, under the right circumstances, result in a defendant sitting at a defense table in a US district court. That signal is aimed at the contractor ecosystem as much as at Xu himself. If you do MSS work and you travel to the wrong country, the indictment with your name on it becomes something more than a press release.

The limitations are equally real. Zhang Yu remains at large. Every other Silk Typhoon, Volt Typhoon, and Salt Typhoon operator currently in China remains beyond reach. The Exchange campaign that hit 12,700 US organizations in a matter of days was so large that prosecuting a single participant, years later, represents justice at the margin rather than accountability at scale. And the MSS has had six years to adjust its contractor vetting, travel policies, and operational security in response to the Xu indictment.

None of that diminishes the significance of April 27, 2026. A Chinese national, accused of stealing COVID-19 vaccine research at the direction of China’s state security apparatus and participating in one of the largest mass cyber exploitation events in history, appeared in an American federal courtroom. Whatever happens next in that courtroom, the precedent that it can happen at all is worth marking.

Sources: DOJ press release; TechCrunch; BleepingComputer; CyberScoop; The Hacker News; Nextgov/FCW; Help Net Security.