The US government has announced the arrest in Milan of 33-year-old Xu Zewei, who is accused of involvement in cyberattacks on US universities, scientists and research institutions during the COVID-19 pandemic. He is being sought by the US for extradition but claims he was the victim of a mix-up.
Xu was arrested on July 3, 2025, after arriving in Italy on holiday with his wife. He faces nine charges, including wire fraud, identity theft and unauthorized access to protected computers.
The US accuses him of being part of the Hafnium group, which is linked to the Chinese government and is involved in the theft of vaccine research and the exploitation of vulnerabilities in Microsoft Exchange. According to the US Department of Justice, he and an accomplice attacked academic institutions, including a university in Texas.
Xu’s defense claims that this is a case of mistaken identity: the surname is common, and the suspect’s phone was stolen in 2020.
The US and China have repeatedly accused each other of cyber espionage. Hafnium is involved in numerous cases involving the use of zero-day vulnerabilities in the software of American companies. Beijing denies the accusations, stating that China “has no need to steal vaccines” and also opposes the extradition of its citizens through third countries.
The case has already caused diplomatic tension – the Chinese Foreign Ministry accused the US of abusing jurisdiction and politicizing cybersecurity.
Xu Zewei’s arrest is another episode in the complex game of international cyber espionage and geopolitical tensions between the US and China. Despite the defense’s claims of false accusations, US prosecutors are certain of his involvement in the attacks on dozens of scientific and medical institutions. The case will be heard by an appeals court in Milan — an extradition decision could have international implications.
SEO
