FBI Director says a trip to Italy that raised questions earlier in 2026 helped set the stage for the arrest of a Chinese national accused of hacking U.S. COVID-19 research.Â
Xu Zewei is now in U.S. custody after what Patel described as a coordinated operation with Italian authorities, marking a rare case in which an alleged state-linked hacker has been extradited to face charges in the United States.
Xu was extradited from Italy in recent days and faces federal charges tied to a 2020â2021 cyber campaign that prosecutors say targeted sensitive research, including work related to COVID-19 treatments and vaccines.
Patel told Fox News Digital in an interview the bureau was able to “directly tie” Xu to s Ministry of State Security and its Shanghai bureau, though additional details remain classified pending declassification.
Patel said the arrest was the result of a carefully coordinated effort with Italian authorities led by Prefect Vittorio Pisani of the Italian National Police, carried out within a narrow window before additional could delay the suspects extradition.
Officials from both countries worked to ensure Xu would be in Italy, and “we created an opportunity with our partners in Italy to have him apprehended there,” Patel said.
Patel told Fox News Digital the trip, which the FBI said included meetings with Italian law enforcement and Olympic security coordination, also helped lay the groundwork for the arrest. He faced criticism at the time after being seen attending Olympic events, with questions raised about whether the travel was primarily official.
Patel described the suspect as “one of the top two cyber criminals in the world for China,” alleging he played a key role in universities, immunologists and virologists during the height of the COVID-19 pandemic.
“We were able to bring him to Houston for prosecution, which is most of what I was doing when people said I was on vacation in Italy,” Patel said. Â
Xu allegedly reported to Chinese intelligence officials after compromising a U.S.-based research university in early 2020, according to the indictment, and allegedly was directed to access email accounts belonging to virologists and immunologists studying COVID-19.Â
Patel said Chinese officials sought to intervene in recent days to prevent Xus extradition from Italy.
Timing was critical, according to Patel, who pointed to past cases where suspected Chinese operatives were able to avoid extradition.Â
In one instance in 2025, he said, a Chinese national detained in Serbia was ultimately returned to China despite U.S. efforts to secure custody.
Authorities allege Xu and his co-conspirators targeted U.S.-based universities, immunologists and virologists working on COVID-19 during the height of the pandemic, gaining access to email accounts and sensitive research.
But the Justice Department has not publicly detailed the specific data allegedly exfiltrated, including whether it included proprietary vaccine formulas, clinical trial data or internal communications between researchers.
Patel said the operation was “specifically engineered at a time when our adversaries were looking to hurt us during COVID,” adding that the suspect targeted research tied to treatments and vaccines.
Prosecutors also allege Xu was involved in exploiting vulnerabilities in Microsoft Exchange Server, a widely used email system, as part of the broader “HAFNIUM” hacking campaign that compromised thousands of computers worldwide, including more than 12,000 organizations in the United States.
The indictment also describes how Chinese intelligence services allegedly rely on private contractors to carry out cyber operations, allowing the government to obscure its direct involvement.
Among the alleged victims was a law firm with offices in Washington, D.C., where prosecutors say attackers searched email accounts for information related to U.S.
