Stay informed with free updates
Simply sign up to the US-China relations myFT Digest — delivered directly to your inbox.
Italian authorities have arrested a Chinese citizen suspected of being linked to a state-sponsored hacking group that sought to steal Covid-19 vaccine secrets from the US at the height of the pandemic in 2020.
Xu Zewei was arrested at Milan’s Malpensa airport on July 3 after an international warrant was issued by the US, Italian police confirmed.
The 33-year-old Chinese national was suspected of being linked to a Chinese government-backed hacking group known as Hafnium that was accused of penetrating Microsoft email software in 2021 in a mass espionage campaign, a person familiar with the matter said.
A nine-count US indictment accusing Xu of participating in a hack targeting US research into Covid vaccines was forthcoming, the person said.
Xu, currently being held at an Italian jail not far from the airport, was expected to be charged with carrying out computer intrusions between February 2020 and June 2021, the person added.
Italy’s ministry of justice confirmed Rome had received a US formal extradition request for Xu.
The US Department of Justice declined to comment. An Italian defence lawyer for Xu, whose extradition proceedings were expected to begin in a Milan court on Tuesday, did not respond to multiple requests for comment.
The arrest of the Chinese national, who claimed to be an IT specialist, could prove diplomatically awkward for Prime Minister Giorgia Meloni’s government, which is squeezed between Washington and Beijing.
Meloni has worked to forge a solid personal relationship with President Donald Trump, and continues to see the US as Italy’s most important ally, despite Washington’s tensions with the EU.
But she has also sought to maintain friendly diplomatic relations with Beijing, despite her decision to withdraw from Chinese President Xi Jinping’s flagship Belt and Road Initiative. Italy’s deputy prime minister, Matteo Salvini, was due to arrive in Beijing for an official visit later this week.
At the height of the Covid pandemic, the FBI and the US Cybersecurity and Infrastructure Security Agency repeatedly accused Beijing of attempting to steal vital coronavirus research by hacking into the computer systems of US groups studying the virus.
In the summer of 2020, the DoJ indicted two other Chinese nationals for allegedly attempting to access US research as part of a decade-long scheme to steal US trade secrets.
Beijing has consistently denied the US claims, saying at the time that China was at the forefront of the global race for Covid vaccines and had no need of help from the west.
Italy has a patchy record of handling extradition requests.
In early January, an Italian court ‘revoked” the arrest of an Iranian engineer sought by US authorities for allegedly illegally exporting sensitive high-tech technology to Iran, just days after Tehran freed a young Italian journalist.
Ahead of the carefully choreographed prisoner exchange, Meloni flew to Trump’s Mar-a-Lago resort to meet the president, who had not yet been sworn in.
In 2023, Artem Uss, a prominent Russian businessman wanted in the US for money-laundering and sanctions evasion escaped house arrest in Italy a day after an Italian court approved his extradition. He later reappeared in Russia.
Meloni’s government subsequently blamed the court for the escape, suggesting Uss had been treated too leniently by being granted house arrest.
Additional reporting by Giuliana Ricozzi in Rome
