US Offers $10 Million Reward for Alleged Chinese Hafnium Hacker
US Department of State’s Rewards for Justice program offers $10 million for details on Zhang Yu, linked to Hafnium attacks targeting Microsoft Exchange servers.
Reward for Information on Zhang Yu
The US Department of State’s Rewards for Justice (RFJ) program has announced a $10 million reward for details about Zhang Yu, a Chinese national implicated in the Hafnium cyber campaign targeting Microsoft Exchange servers. The initiative, disclosed on Wednesday, focuses on Zhang, who is accused of collaborating with Xu Zewei, a defendant extradited from Italy to the United States in April 2026.
Xu Zewei and the Indictment
According to the RFJ, Zhang served as a director at Shanghai Firetech Information Science and Technology Company and is alleged to have acted on behalf of the Shanghai State Security Bureau (SSSB), a division of China’s Ministry of State Security (MSS). The two individuals were named in a nine-count indictment unsealed in July 2025, following Xu’s arrest by Italian authorities at the request of US law enforcement.
Roles and Arrest Details
Xu, who previously held the position of general manager at Shanghai Powerock Network Co. Ltd., has appeared in federal court in Houston, while Zhang remains at large. The indictment details that Zhang and Xu engaged in unauthorized access to sensitive research related to COVID-19 conducted by US-based universities and medical experts starting in early 2020.
Hafnium Campaign and Cybersecurity Impact
The following year, they exploited vulnerabilities in Microsoft Exchange Server as part of the Hafnium operation. The campaign affected thousands of systems globally, with victims including a US university and a law firm. Microsoft first revealed the Hafnium attacks in March 2021 and now classifies the threat actor as Silk Typhoon.
FBI Statement on Hafnium
The FBI stated that the Hafnium campaign compromised over 12,700 US organizations at the time of Xu’s extradition.
Program Purpose and Cybersecurity Concerns
The reward is part of the RFJ program’s efforts to gather intelligence on individuals targeting US critical infrastructure in violation of the Computer Fraud and Abuse Act while operating under the direction of a foreign government. The case highlights ongoing concerns about state-sponsored cyber activities and their impact on global cybersecurity.
According to the RFJ, Zhang served as a director at Shanghai Firetech Information Science and Technology Company and is alleged to have acted on behalf of the Shanghai State Security Bureau (SSSB), a division of China’s Ministry of State Security (MSS).
The FBI stated that the Hafnium campaign compromised over 12,700 US organizations at the time of Xu’s extradition.
The US government continues to emphasize the importance of addressing threats that exploit software vulnerabilities to compromise sensitive data and infrastructure.
About Author
English