U.S. Offers Up to $10 Million for Information on HAFNIUM Suspect Zhang Yu

The U.S. State Department has offered up to $10 million for information leading to the identification or location of Chinese national Zhang Yu. He is charged in the United States over the 2021 Microsoft Exchange Server attacks known as HAFNIUM, the outlet NTD reported, citing a notice from the department's Rewards for Justice program.

U.S. authorities say Zhang remains at large and has not been arrested; the charges against him have not been tested in court. Rewards for Justice is the State Department's national security rewards program, which says it has paid more than $250 million to over 125 people since 1984.

Zhang is wanted for his alleged role in "malicious cyber activities against U.S. critical infrastructure." Both the amount and the wording match an offer the program was already making in January 2025, aimed at anyone who hacks U.S. infrastructure at the direction of a foreign government.

The charges

Zhang and a second man, Xu Zewei, are charged together in federal court in Houston. The nine-count indictment dates from November 2023 and was made public in July 2025. The alleged activity took place between February 2020 and June 2021.

Xu was arrested in Milan in July 2025 at the request of the United States, and Italy extradited him in April 2026. The FBI noted that Xu is "one of many contractors the Chinese government uses to obscure its hand in cyber operations."

Zhang is described as a director at Shanghai Firetech Information Science and Technology. According to the indictment, he worked on tasks assigned by the Shanghai State Security Bureau — a branch of China's Ministry of State Security — supervised hacking by other Firetech staff, and coordinated with Xu. Xu, in turn, allegedly worked for another Shanghai company, Shanghai Powerock Network.

The indictment describes two sets of intrusions. The first, in early 2020, targeted U.S. universities and scientists working on COVID-19 vaccines and treatments. The second, from late 2020, exploited flaws in Microsoft Exchange Server — the campaign later called HAFNIUM. The alleged victims include two Texas universities and an international law firm with a Washington, D.C., office.

The HAFNIUM campaign

Microsoft disclosed the Exchange attacks on March 2, 2021, releasing fixes for four zero-day flaws, including ProxyLogon. It blamed HAFNIUM, "a group assessed to be state-sponsored and operating out of China"; Microsoft now tracks the group as Silk Typhoon. Within days, other groups began exploiting the same flaws. The FBI says the campaign as a whole compromised more than 12,700 U.S. organizations.

Source: The Hacker News