US prosecutors say 34-year-old Xu Zewei hacked into universities to steal vaccine research during COVID-19 pandemic. 

Italy has extradited an accused Chinese hacker wanted in the United States for allegedly stealing vaccine research at the height of the COVID-19 pandemic.

Italian authorities handed over the “dangerous foreign hacker” to the US following his arrest in Milan last July on suspicion of conducting cyberattacks against universities and other institutions engaged in COVID-related research, the Italian National Police said in a statement on Monday.

The suspect and his co-conspirators allegedly exploited cybersecurity flaws in email software to target thousands of computers in a Chinese state-sponsored cyber-espionage campaign dubbed “Hafnium”, Italian police said.

The US Department of Justice said the suspect, 34-year-old Xu Zewei, had targeted universities, immunologists, and virologists under the direction of China’s Ministry of State Security while employed at the “enabling” company Shanghai Powerock Network.

Prosecutors said the targeted institutions included a university in southern Texas and a law firm with offices in Washington, DC, and worldwide.

Xu appeared in the US District Court in Houston, Texas, on Monday to face nine criminal counts, including wire fraud and conspiracy to obtain information by unauthorised access to protected computers, according to US prosecutors.

“The United States is committed to pursuing hackers who steal information from US businesses and universities and threaten our cybersecurity,” Assistant Attorney General for National Security John A Eisenberg said in a statement.

“I commend the prosecutors and investigators who have worked hard and sought justice for years in this investigation, and we look forward to proving our case in court,” Eisenberg said.

The Chinese Embassy in Washington, DC, did not immediately respond to a request for comment.

Beijing has previously denied conducting hacking operations in the US and elsewhere around the world, branding such claims as “groundless accusations” and “smears”.

Xu’s lawyers in Italy and the US, Simona Candido and Dan Cogdell, did not immediately respond to requests for comment.

If convicted, Xu could face up to 20 years in prison for each count of the most serious charges against him.