A Chinese Secret Police Proxy Stole COVID Research. Then He Went to Milan.

Photo from Italian justice sources of Xu Zewei under arrest.

HOUSTON – For more than four years, Xu Zewei moved freely through China’s technology sector, beyond the reach of American justice. A 34-year-old Chinese national based in Shanghai, he had spent the height of the pandemic breaking into American universities, stealing the email accounts of virologists and immunologists racing to understand a novel coronavirus, and quietly reporting his findings to handlers inside China’s Ministry of State Security — as the world sheltered, and its scientists scrambled, and Beijing watched.

By 2021, he had graduated to an even larger campaign — one that would compromise more than 12,700 organizations worldwide. Then he got on a plane to Italy, and the long arm of American justice finally caught up with him.

Xu appeared in federal court in Houston this weekend following his extradition from Milan, where Italian authorities — working with the Polizia Postale, Italy’s cyber crimes unit — arrested him on behalf of the United States government. He now faces a nine-count federal indictment that spans wire fraud, unauthorized computer access, and aggravated identity theft. His alleged co-conspirator, Zhang Yu, 44, remains at large.

"Today, Xu Zewei will stand in a federal courtroom to answer for crimes that struck at the heart of American science and security — allegedly stealing COVID-19 research from our universities when the world needed it most," said Acting United States Attorney John G.E. Marck for the Southern District of Texas. "We have pursued this moment across years and continents."

What Xu had allegedly been doing in the years between the crimes and his arrest offers a window into how Beijing’s contractor ecosystem actually works.

After his arrest, his spouse reportedly informed Italian police that he had moved on to a new role entirely: information technology manager at Shanghai GTA Semiconductor, developing systems and network infrastructure for a company that controls roughly 80 percent of China’s domestic market for automotive chips used in electric vehicles, counting BYD among its clients.

A state-directed hacker, quietly embedded in a strategic industry — and one whose flagship client, BYD, is now poised to enter the Canadian market under a landmark trade deal Prime Minister Mark Carney negotiated in Beijing in January. The Chinese government wasted no time casting the arrest as American aggression against China’s technological rise.

The charges offer a rare window into how Beijing conducts its cyber operations — not through uniformed military hackers, but through a deliberately obscured ecosystem of private contractors and front companies. Two separate enabling firms, operating in parallel, under the supervision and direction of two named Shanghai State Security Bureau officers, according to U.S. court filings.

Xu allegedly worked as general manager of Shanghai Powerock Network Co. Ltd., supervising other hackers and coordinating with Zhang Yu, a director at a second front company, Shanghai Firetech Information Science and Technology Company.

The arrangement is designed to give Beijing plausible deniability while flooding western institutions with intrusions far broader than any single intelligence priority would require. Much of what these contractors steal, prosecutors say, gets sold to whoever in China will pay for it. The greater objective from Beijing’s sprawling intelligence apparatus, experts say, appears to be boosting China’s technological rise.

Xu’s alleged activities began in February 2020, in the early weeks of the pandemic, when the world was desperate for treatments and a vaccine. Court documents describe Shanghai State Security Bureau officers directing him to target specific researchers — virologists, immunologists — at a university in the Southern District of Texas.

The operation was surgical in its focus: Xu allegedly confirmed to a bureau officer that he had penetrated the university’s network, received instructions to access specific mailboxes belonging to COVID-19 researchers, and then confirmed he had done so.

The scale of Beijing’s interest became clearer as the operation expanded.

Court documents show that as early as February 5, 2020 — weeks before the World Health Organization declared a pandemic — Shanghai State Security Bureau officers were already directing Xu to conduct reconnaissance on a second university, this one based in North Carolina, with specific attention to its school of public health and a professor engaged in COVID-19 research.

The timing is striking. China’s intelligence apparatus was tasking contractors to steal American pandemic research at the very moment the world was still struggling to understand the disease that had emerged from Wuhan.

By late 2020, his alleged activities had expanded into something far more sweeping — and more explicitly political.

The indictment describes how the conspirators used their access to target a Washington law firm specifically chosen, prosecutors say, for its insight into United States government policies and policymakers. Once inside, Xu and his associates conducted hundreds of searches of attorney mailboxes, hunting for information on specific American officials and agencies. Their search terms included “Chinese sources,” “MSS,” and “Hong Kong.”

The Ministry of State Security was, in effect, searching a Washington law firm's files for intelligence about United States investigations and policymakers. The search terms — "Chinese sources," "MSS," "Hong Kong" — suggest investigators believe Beijing may also have been hunting for information about American intelligence sources inside China itself.

That targeting was part of a still larger campaign.

Xu and his co-conspirators joined what would become one of the most consequential state-sponsored hacking operations in recent memory, exploiting vulnerabilities in Microsoft Exchange Server to compromise more than 12,700 organizations worldwide.

In March 2021, Microsoft publicly disclosed the intrusion campaign, attributing it to a Chinese state-sponsored group it called HAFNIUM. By July of that year, the United States and its allies — the European Union, the United Kingdom, and the North Atlantic Treaty Organization — formally attributed HAFNIUM to the Ministry of State Security and condemned it as an indiscriminate, reckless, and destabilizing attack on critical infrastructure across allied nations.

The United States has previously unsealed indictments against Ministry of State Security officers and their proxies — largely symbolic gestures aimed at attribution and deterrence — but extracting a defendant from foreign soil requires a combination of intelligence, law enforcement coordination, and, above all, luck. Or bad judgment on the part of the target.

Xu, it appears, provided the last ingredient himself.