Hafnium-affiliated hacker Xu Zewei's arrest and China's cyber ecosystem

Security researchers documented the complex relationships surrounding Hafnium-affiliated hacker Xu Zewei, who was arrested at Milan airport and faces extradition for allegedly stealing COVID-19 research and exploiting Microsoft Exchange vulnerabilities. The Justice Department’s announcement lists nine counts unsealed in the Southern District of Texas, says officers of the Shanghai State Security Bureau directed the hacking, and names a co-defendant, Zhang Yu, who remains at large. The investigation reveals connections between Shanghai State Security Bureau, companies like Shanghai Powerock Network and Chaitin Tech, demonstrating China’s interconnected “cyber ecosystem” where talent serves multiple interests. SentinelOne’s analysis reveals advanced capabilities including patented forensic technologies for remote evidence collection and sophisticated coordination between state security offices and private companies.