Chinese hackers vulnerable to U.S. arrest if they travel

The Chinese government’s hack-for-hire ecosystem has “gotten out of control” and provides cyber criminals with “a form of plausible deniability,” a senior FBI official said ​on Thursday, warning that Chinese hackers can be arrested when they travel ‌outside their home country.

FBI Assistant Director Brett Leatherman’s comments come days after the extradition of Chinese national Xu Zewei, 34, to the U.S. from Italy on allegations of participating in ​widespread hacking campaigns carried out in 2020 and 2021 at the direction ​of the Chinese government while working for a Chinese contractor.

Xu was ⁠arrested in Milan in July 2025 and was sent to the U.S. ​after an Italian court ruling allowed the extradition.

Protection that Chinese hackers receive "inside China ​does not extend the moment you cross a border," Leatherman said.

The Chinese Embassy in Washington did not respond to a request for comment.

Chinese Foreign Ministry Spokesperson Lin Jian said, on April ​27 that the Chinese government opposed Washington "fabricating charges through political manipulation,” and urged ​the Italian government to “avoid becoming an accomplice of the U.S.”

Xu, along with several co-conspirators, hacked ‌U.S.-based ⁠universities, immunologists, and virologists conducting research into COVID-19 vaccines, treatment, and testing, the Department of Justice said on April 27.

Xu and others reported the hacking to the Chinese Ministry of State Security’s Shanghai State Security Bureau, an intelligence agency ​within the Chinese government, ​according to the ⁠DOJ. An officer within the bureau then directed Xu to target specific email accounts belonging to virologists and immunologists.

Xu ​and others were also responsible for exploiting vulnerabilities in the ​Microsoft Exchange ⁠Server email program as part of a widespread hacking campaign tracked publicly as “Hafnium,” according to the DOJ.

A senior DOJ official told reporters on Thursday that the Hafnium ⁠campaign ​included targeting law firms, with the hackers searching ​for information about U.S. policymakers and government agencies.

Lawyers listed as representing Xu did not immediately respond to ​a request for comment.

- Reuters