Houston FBI agents have arrested Xu Zewei, a suspected hacker linked to China’s Ministry of State Security, in Milan, Italy.
Xu is one of the first hackers tied to Chinese intelligence to be captured by U.S. authorities.
Recommended Videos
According to an indictment unsealed in Nov. 2023, Xu and co-conspirator Zhang Yu were directed by the MSS to target American immunologists, virologists, and institutions conducting COVID-19 vaccine research in early 2020.
They allegedly stole sensitive data from U.S. universities and exploited vulnerabilities in Microsoft Exchange Server as part of the HAFNIUM cyber campaign, which compromised thousands of computers worldwide.
In Texas, authorities say Xu confirmed breaching a university’s network in February 2020, then accessed the email accounts of immunologists and virologists working on COVID-19 research. He later reported his findings to Chinese intelligence officers, according to court records.
Xu worked for Shanghai Powerock Network Co. Ltd., a company accused of enabling hacking activities for the Chinese government. The charges include wire fraud, conspiracy, identity theft, and unauthorized access to protected computers, carrying potential prison terms up to 20 years.
U.S. Attorney Nicholas Ganjei said the arrest signals the Justice Department’s commitment to pursuing cybercriminals, even years after their offenses. FBI Houston’s Special Agent in Charge Douglas Williams emphasized the global reach of their investigations and vowed to hold foreign adversaries accountable.
Zhang Yu remains at large. Authorities urge anyone with information on his whereabouts to contact the FBI.
The University of Texas Medical Branch released a statement, confirming they were among the Texas-based institutions targeted by the hackers.
“The University of Texas Medical Branch is grateful to the FBI and all involved law enforcement agencies for their diligence in pursuing this investigation. We can confirm that UTMB was among the universities targeted; however, because this matter remains an active, ongoing investigation by the FBI and other authorities, we are unable to provide further comment at this time.”
