FBI Director Kash Patel says a trip to Italy that raised questions earlier in 2026 helped set the stage for the arrest of a Chinese national accused of hacking U.S. COVID-19 research. 

Xu Zewei is now in U.S. custody after what Patel described as a coordinated operation with Italian authorities, marking a rare case in which an alleged state-linked hacker has been extradited to face charges in the United States.

Xu was extradited from Italy in recent days and faces federal charges tied to a 2020–2021 cyber campaign that prosecutors say targeted sensitive research, including work related to COVID-19 treatments and vaccines.

Patel told Fox News Digital in an interview the bureau was able to «directly tie» Xu to China’s Ministry of State Security and its Shanghai bureau, though additional details remain classified pending declassification.

FBI DIRECTOR KASH PATEL SAYS BUREAU RAMPING UP AI TO COUNTER DOMESTIC, GLOBAL THREATS

Patel said the arrest was the result of a carefully coordinated effort with Italian authorities led by Prefect Vittorio Pisani of the Italian National Police, carried out within a narrow window before additional legal challenges could delay the suspect’s extradition.

Officials from both countries worked to ensure Xu would be in Italy, and «we created an opportunity with our partners in Italy to have him apprehended there,» Patel said.

Patel told Fox News Digital the trip, which the FBI said included meetings with Italian law enforcement and Olympic security coordination, also helped lay the groundwork for the arrest. He faced criticism at the time after being seen attending Olympic events, with questions raised about whether the travel was primarily official.

Patel described the suspect as «one of the top two cyber criminals in the world for China,» alleging he played a key role in hacking efforts aimed at American universities, immunologists and virologists during the height of the COVID-19 pandemic.

«We were able to bring him to Houston for prosecution, which is most of what I was doing when people said I was on vacation in Italy,» Patel said.  

Xu allegedly reported to Chinese intelligence officials after compromising a U.S.-based research university in early 2020, according to the indictment, and allegedly was directed to access email accounts belonging to virologists and immunologists studying COVID-19. 

Patel told Fox News Digital in an interview the bureau was able to «directly tie» Xu to China’s Ministry of State Security and its Shanghai bureau, though additional details remain classified pending declassification. (FBI)

Patel said Chinese officials sought to intervene in recent days to prevent Xu’s extradition from Italy.

Timing was critical, according to Patel, who pointed to past cases where suspected Chinese operatives were able to avoid extradition. 

In one instance in 2025, he said, a Chinese national detained in Serbia was ultimately returned to China despite U.S. efforts to secure custody.

Authorities allege Xu and his co-conspirators targeted U.S.-based universities, immunologists and virologists working on COVID-19 during the height of the pandemic, gaining access to email accounts and sensitive research.

But the Justice Department has not publicly detailed the specific data allegedly exfiltrated, including whether it included proprietary vaccine formulas, clinical trial data or internal communications between researchers.

Patel said the operation was «specifically engineered at a time when our adversaries were looking to hurt us during COVID,» adding that the suspect targeted research tied to treatments and vaccines.

FBI Director Kash Patel looks on before the men’s gold medal ice hockey match between Canada and the United States at the Milano Cortina 2026 Winter Olympics in Milan, Italy, on Feb. 22, 2026. (Elsa/Getty Images)

Prosecutors also allege Xu was involved in exploiting vulnerabilities in Microsoft Exchange Server, a widely used email system, as part of the broader «HAFNIUM» hacking campaign that compromised thousands of computers worldwide, including more than 12,000 organizations in the United States.

The indictment also describes how Chinese intelligence services allegedly rely on private contractors to carry out cyber operations, allowing the government to obscure its direct involvement.

Among the alleged victims was a law firm with offices in Washington, D.C., where prosecutors say attackers searched email accounts for information related to U.S. policymakers and government agencies.

Xu’s alleged co-conspirator, who was also charged in the case, remains at large.

Patel declined to discuss specifics about the broader network but said China’s Ministry of State Security continues to actively target the United States through cyber operations.

«The MSS is always a target of this FBI’s. They’re always operating whether it’s to steal our classified information, our nation’s research and scientific information, or anything they can use to embarrass us or leverage against us,» Patel said. «They’re going to keep doing it.»

CHINESE SCHOLARS CHARGED WITH SMUGGLING BIOLOGICAL MATERIALS INTO US UNDER RESEARCH COVER

Patel said the FBI has made countering Chinese espionage a top priority, pointing to a sharp increase in arrests tied to Beijing-linked activity.

«We’ve arrested more Chinese spies than any FBI before me,» he said. 

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Patel signaled that efforts to identify and prosecute individuals tied to similar operations are ongoing.

«It’s a priority threat and it’s going to continue to be that way,» he said.

The Chinese embassy did not immediately respond to a request for comment. 

A German tourist has died after a venomous cobra featured in a snake show reportedly slithered up his pants and bit him on the leg, authorities said.

The freak accident occurred early April at a luxury resort destination in Egypt, according to the Bavarian State Police in Germany, which released details Monday.

«During the snake charmer’s performance, one of the snakes crawled into the trousers of a 57-year-old man, resulting in a bite to the German tourist’s leg,» officials said. 

Police said the victim, whose identity was not released, was on vacation with two family members from the Unterallgäu region of Germany.

BILLIONAIRE’S DEATH AFTER SWALLOWING BEE RAISES QUESTIONS ABOUT RARE CARDIAC REACTION

Authorities said the snake charmer event was part of a hotel entertainment program in the resort city of Hurghada, a popular Red Sea destination known for its upscale all-inclusive packages, as well as nearby desert and water excursions.

Two snakes, believed to be cobras, were used in the show, officials said. 

Investigators indicated that it is not uncommon for performers to allow snakes to interact closely with audience members, as some of the snakes were reportedly placed around guests’ necks during the act.

However, during one segment of the performance, a snake reportedly bit the German tourist after crawling into his clothing.

«He subsequently exhibited clear symptoms of poisoning and required resuscitation,» officials said. 

He reportedly died shortly after arriving at a local hospital.

LAW STUDENT KILLED BY ELEPHANT DURING VACATION TO THAILAND: OFFICIALS

Tourists swim in the Sunny Days Elpalacio beach in the Egyptian Red Sea resort city of Hurghada. (MOHAMED EL-SHAHED / AFP)

The results of a toxicological examination are still pending, Bavarian police said.

The investigation is being handled by Germany’s Memmingen Criminal Police Inspectorate under the direction of the Memmingen Public Prosecutor’s Office (MPPO).

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Tourists swimming at the Red Sea Egyptian resort of Hurghada on June 18, 2020 (KHALED DESOUKI/AFP)

Cobras are known for being highly venomous snakes. Their bite can lead to rapid respiratory failure and paralysis without prompt medical treatment.

Fox News Digital has reached out to MPPO for more information.   

La Policía Control de Drogas (PCD) de Costa Rica detuvo este martes a 17 integrantes de una estructura criminal dedicada a la venta de drogas en las inmediaciones de centros educativos en diferentes barrios de Puntarenas, como resultado de una investigación iniciada en marzo de 2024. El operativo, realizado en 23 allanamientos simultáneos y con el apoyo de unidades especiales, permitió desarticular una red que, tras una serie de conflictos internos y violentos cambios de liderazgo, venía operando en la zona de Caldera y extendiéndose hacia Barranca y Chacarita.

Entre los resultados de este despliegue coordinado, la PCD decomisó 1.683.5 gramos de marihuana, 114 dosis de marihuana, 749.2 gramos de cocaína, 195 dosis de crack, un millón 897 mil colones, USD 4,459, 10 armas de fuego y 349 municiones, además de radios de comunicación, implementos para dosificación, una moledora eléctrica, dos cajas fuertes y 240 pares de artículos deportivos. Estos datos confirman la magnitud operativa y logística de la organización, cuyos miembros eran principalmente jóvenes entre 18 y 33 años.

El grupo criminal fue originalmente dirigido por Garbanzo Rodríguez, conocido como “Mufasa” y residente de Pavas, San José. Según la PCD, Mufasa tenía conexiones con estructuras como la de Marco Antonio Zamora Solórzano(“Indio”), Los Paveños y Los Myrie, lo que facilitó la distribución de cocaína, marihuana y crack en Caldera durante más de cinco años. En ese periodo, Mufasa se apropió de viviendas ajenas con el objetivo de controlar puntos de venta, incluso desplazando a vecinos que rechazaban involucrarse.

El 15 de agosto de 2025, Mufasa fue asesinado en un bar de Santa Ana en medio de disputas territoriales. Tras su homicidio, el liderazgo recayó en Rojas Rodríguez, alias “Moti”, hermano de Mufasa, quien, con el apoyo de otros miembros, dirigió una etapa de expansión hacia Barranca y Chacarita en Puntarenas. Este cambio precipitó divisiones internas y episodios violentos.

La fragmentación de la organización provocó al menos tres víctimas mortales en 2025: el propio Garbanzo Rodríguez(“Mufasa”) en agosto, Vargas Montero (“Pingo”) en noviembre y Cordero Mora el 20 de diciembre. Además, Moti sobrevivió a un atentado en diciembre de ese mismo año.

La PCD detalló que la estructura estaba integrada por hombres y mujeres jóvenes que cumplían roles diferenciados. Además de Mufasa y Moti, entre los líderes se identificó a Monge Ramírez (28 años), encargado de abastecer el principal punto de venta y con antecedentes por receptación y tenencia de drogas; aunque, según las investigaciones, posteriormente se habría desligado del grupo.

Como vendedores participaron personas de entre 18 y 36 años, como Serrano Montero (“Calufa”, 21), Araya Rodríguez (“Chino”, 22), Montoya Arroyo (diversos registros de edad y antecedentes), Bustos Montero (20), Jiménez Bejarano (29), Chaves Núñez (20) y García Medina (36), la mayoría con antecedentes policiales por infracción a las leyes de tenencia y consumo de drogas. Entre las mujeres identificadas como vendedoras figuran las hermanas Rodríguez Montero (19 y 23 años) y Cabrera Araya (20), aunque no todas registraban antecedentes previos.

La administración del dinero recaía en Obando Guerrero, alias “Gamuza” (34 años), encargado, según las pesquisas, de gestionar préstamos bajo el esquema conocido como “Gota a Gota”.

La intervención en Caldera y barrios aledaños, Salinas, Mata de Limón, Villanueva, Cambalache y Santa Marta— incluyó el allanamiento de 23 viviendas vinculadas a la red investigada. El despliegue contó con la participación de G-TRES, la Unidad de Intervención del Ministerio de la Presidencia, la Unidad Especial de Apoyo, la Dirección de Inteligencia y Análisis Criminal (DIAC), Guardacostas y Fuerza Pública, en coordinación con la Policía Control de Drogas.

De acuerdo con el reporte oficial de la PCD, el objetivo de las acciones fue recolectar pruebas y detener a sospechosos de liderar o participar en el narcomenudeo local. En 2023, la policía había intervenido puntos asociados a esta red y detenido a tres personas vinculadas al mismo entramado delictivo.

El operativo de este martes permitió desarticular en su totalidad a los 17 objetivos identificados por la investigación policial. La acción estuvo dirigida a reforzar la seguridad de las comunidades cercanas a centros educativos y contener la expansión de células criminales que, según la PCD, habían desarrollado una estructura compleja y eran capaces de reciclar sus liderazgos tras episodios violentos, además de articularse con otras organizaciones para la distribución de drogas en la provincia de Puntarenas.