Alleged Silk Typhoon/HAFNIUM hacker Xu Zewei extradited from Italy to the U.S.

Xu Zewei, a Chinese national the U.S. accuses of hacking for China's Ministry of State Security, has been extradited from Italy and appeared in federal court in Houston on 27 April 2026. The charges are tied to the HAFNIUM (Silk Typhoon) campaign, which in 2021 hit Microsoft Exchange servers on a scale that made patching on-premises Exchange an emergency for operations teams worldwide.

What happened

According to the U.S. Department of Justice, Xu, 34, was arrested in Milan at the request of the United States. CyberScoop and The Record report that the arrest took place in July 2025. Italy extradited him in late April 2026, and he made his first appearance in the U.S. District Court for the Southern District of Texas on 27 April. An arrest warrant was first filed in that district in November 2023. A nine-count indictment charges Xu and co-defendant Zhang Yu, who remains at large, with:

• conspiracy to commit wire fraud and two counts of wire fraud
• conspiracy to damage and obtain information from protected computers, commit wire fraud and commit identity theft
• two counts of unauthorized access to obtain information from protected computers
• two counts of intentional damage to a protected computer
• aggravated identity theft

Prosecutors allege that between February 2020 and June 2021 Xu worked for Shanghai Powerock Network Co. Ltd., which the DOJ describes as one of many "enabling" companies that hack on behalf of the PRC government, under the direction of the MSS's Shanghai State Security Bureau. The alleged targets included U.S. universities and researchers working on COVID-19 vaccines, treatments and testing. From late 2020, Xu and others allegedly exploited Microsoft Exchange Server vulnerabilities as part of HAFNIUM. The FBI says that campaign compromised more than 12,700 U.S. organisations. The indictment also alleges theft of information about U.S. policymakers from a law firm with offices in Washington, and the planting of web shells for persistent access. Xu has said through his lawyer that this is a case of mistaken identity. These are allegations, and he is presumed innocent.

Who is affected

The extradition doesn't create new risk on its own. The underlying campaign affected organisations that ran on-premises Microsoft Exchange Server 2013, 2016 and 2019 in early 2021. Microsoft disclosed the four zero-days on 2 March 2021: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065, collectively known as ProxyLogon. Universities, research labs, law firms and government contractors were the main stated targets. Any Exchange server that was exposed and unpatched in early 2021 could also have received a web shell.

What it means for developers and engineering teams

This is a law-enforcement story, so its technical relevance is mostly historical. Two lessons still hold. First, ProxyLogon chained a server-side request forgery (CVE-2021-26855) with post-authentication file-write bugs to drop ASPX web shells. Those web shells survived patching, which is why "we patched" did not mean "we're clean." Second, the DOJ's description of contractor firms like Powerock fits a wider pattern. State-linked intrusion is increasingly outsourced to private companies, which tends to mean broad, opportunistic mass exploitation of internet-facing appliances and mail servers rather than narrowly targeted attacks. If you run anything internet-facing that you don't patch within days, assume these groups will scan it.

The timeline is worth noting too. The intrusions allegedly date to 2020–2021, the warrant to 2023, and the extradition to 2026. Charges and arrests come years after the compromise and do nothing to clean up systems that were breached. Any web shell or stolen credential from that period is a matter for your own incident response, not for the courts.

What to do now

• If you still run on-premises Exchange, confirm it's on a supported build with current security updates. Exchange 2013 is out of support, and 2016 and 2019 reached end of support in October 2025, so plan a migration if you haven't.
• Check Exchange web directories for unexpected .aspx files, for example under inetpub\wwwroot\aspnet_client and the OWA auth folders.
• Keep an inventory of internet-facing services and set a patch SLA for critical, actively exploited CVEs. CISA's Known Exploited Vulnerabilities catalog is a good trigger list.
• Put admin and mail interfaces behind a VPN, a zero-trust proxy or pre-authentication where possible, rather than exposing them directly.
• Monitor for web-shell behaviour, such as IIS worker processes (w3wp.exe) launching cmd.exe or PowerShell.

Related on TechLogHub

• Authentication: ProxyLogon's first bug was an authentication bypass
• HTTP: background on the request-forgery primitive

Sources

• U.S. DOJ: Prolific Chinese state-sponsored contract hacker extradited from Italy (27 April 2026)
• CyberScoop: Xu Zewei extradited
• The Record: Italy extradites alleged Chinese state hacker
• Microsoft: HAFNIUM targeting Exchange Servers with 0-day exploits (2 March 2021)