From Shanghai to Houston: The HAFNIUM Hacker Who Stole Vaccine Secrets Faces Justice

The report details the extradition and federal indictment of Xu Zewei, alleged to have worked for a front company under direction of the Shanghai State Security Bureau and played a role in HAFNIUM’s large-scale intrusion campaign (Feb 2020–Jun 2021) that exploited Microsoft Exchange zero-day vulnerabilities to install web shells, exfiltrate data from over 12,700 U.S. organizations, and specifically target virologists and immunologists conducting COVID‑19 vaccine research.