U.S. offers $10 million reward for Chinese national Zhang Yu

The U.S. State Department’s Rewards for Justice program is offering up to $10 million for information leading to Zhang Yu’s identification or location. Zhang Yu is a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM.

Zhang Yu’s alleged role in HAFNIUM

U.S. authorities describe Zhang as a director at Shanghai Firetech Information Science and Technology, a Shanghai company. Officials say he worked at the direction of the MSS Shanghai State Security Bureau (SSSB). According to the indictment, he worked on tasks assigned by the Shanghai State Security Bureau, supervised hacking by other Firetech staff, and coordinated the hacking with his alleged partner, Xu Zewei.

Starting in early 2020, Zhang Yu and Xu Zewei allegedly gained unauthorized access to COVID-19 research conducted by U.S.-based universities and leading immunologists and virologists to steal sensitive information. Prosecutors say the men carried out the hacks at the behest of the Ministry of State Security and SSSB and reported back to supervising officers. In 2021, they allegedly exploited vulnerabilities in computers running Microsoft Exchange Server as part of the mass hacking campaign publicly known as HAFNIUM.

The HAFNIUM campaign and its impact

The alleged hacking took place between February 2020 and June 2021. The indictment alleges two sets of intrusions. The first, in early 2020, targeted U.S. universities and scientists working on COVID-19 vaccines, treatment, and testing. The second, from late 2020, exploited flaws in Microsoft Exchange Server in the campaign later called HAFNIUM.

Microsoft disclosed the Exchange attacks on March 2, 2021, and released fixes for four zero-day flaws, including the one known as ProxyLogon. Microsoft blamed HAFNIUM, which it described as a group assessed to be state-sponsored and operating out of China. The FBI says the HAFNIUM campaign as a whole compromised more than 12,700 U.S. organizations. Victims included two Texas universities and an international law firm with an office in Washington, D.C.

Legal status and co-defendant

Zhang Yu remains at large. His alleged partner, Xu Zewei, was arrested in Italy in July 2025 and extradited to the United States in April 2026. Zhang and Xu are charged together in a nine-count indictment in federal court in Houston. The indictment, dated November 2023 and made public in July 2025, accuses both men of computer intrusions.

U.S. officials describe the two men as key figures in the HAFNIUM hacking campaign. The Justice Department calls their companies part of an extensive network of private contractors used by China to hack and steal information in a way that hides the government’s involvement. The State Department says Zhang Yu’s cyberattacks violated the Computer Fraud and Abuse Act.

The Rewards for Justice program is asking anyone with information on Zhang Yu, his associates, or their malicious cyber activities to submit a tip through its Tor-based tip line. The reward covers information leading to the identification or location of anyone who, while acting under the direction or control of a foreign government, takes part in malicious cyber activity against U.S. critical infrastructure. The Justice Department continues to seek public information about Zhang Yu’s whereabouts.