Chinese national charged in Texas for alleged US cyber espionage scheme

Xu Zewei, a 33-year-old Chinese citizen of Han Chinese background and an IT manager for a technology company in Shanghai, was arrested in Milan earlier this month at the request of the U.S. Department of Justice.

Xu faces a nine-count indictment in the Southern District of Texas for his alleged involvement in a series of cyber intrusions and data thefts targeting U.S. universities and research institutions between February 2020 and June 2021. The indictment also names Zhang Yu, a 44-year-old Chinese national, as a co-defendant who remains at large in China.

Federal prosecutors allege that Xu and Zhang conspired to breach the computer networks of American universities, including an institution in Texas, to steal COVID-19 vaccine and treatment research, proprietary business data and employee credentials. Investigators say the pair exploited zero-day vulnerabilities in Microsoft Exchange Server, used spear-phishing emails and deployed sophisticated malware to access protected information from organizations in Texas, North Carolina and Washington, D.C. The FBI responded in 2021 with a reverse-hack operation to remove malware and secure digital evidence.

Xu is currently being held in Italy as he awaits extradition to the U.S. If convicted, he faces up to 20 years in prison for wire fraud and up to 10 years for unauthorized computer access. U.S. authorities continue to work with international partners to identify further victims, collect evidence and pursue charges against Zhang and other possible co-conspirators.