US authorities have charged a suspected hacker linked to breaches targeting COVID-19 research institutions. The case highlights ongoing enforcement against cyber operations aimed at sensitive healthcare and academic data.
The suspect, identified as Xu, was extradited from Italy to the United States over the weekend. Officials allege involvement in hacking campaigns between 2020 and 2021 that targeted universities and medical researchers working on vaccines and treatments.
How Significant Was The HAFNIUM Cyber Campaign?
The FBI linked Xu to HAFNIUM, a group accused of compromising nearly 13,000 US organizations. The campaign focused on gaining access to email systems and extracting sensitive research, raising concerns about state-linked cyber capabilities during a global health crisis.
Authorities said the investigation involved close coordination with Italian law enforcement. The joint effort resulted in Xu’s arrest and transfer to US custody, reflecting cross-border cooperation in cybercrime enforcement.
“This operation shows authorities will act against threats targeting US systems,” said FBI Director Kash Patel, describing the case as a major step in cyber enforcement.
The FBI and our great partners have arrested Xu Zewei - a PRC national and state-sponsored hacker - allegedly responsible for a massive cyber intrusion campaign in 2020 and 2021 stealing COVID-19 research from American institutions.
— FBI Director Kash Patel (@FBIDirectorKash) April 28, 2026
Xu has been extradited to the U.S. out of… pic.twitter.com/d3jdIK09Xo
Still, the case unfolds alongside separate legal developments involving Patel. He has filed a $250 million defamation lawsuit against The Atlantic and reporter Sarah Fitzpatrick, alleging false reporting about his conduct in office.
The next phase will center on federal court proceedings against Xu, with prosecutors expected to detail the scope of the alleged intrusions and any broader links to coordinated cyber activity.
