US Offers $10 Million Reward for Information on Chinese National Accused in Hafnium Cyber Campaign

The United States Department of State has escalated its efforts to apprehend individuals linked to high-profile state-sponsored cyberespionage, announcing a reward of up to $10 million for information leading to the location or identification of Zhang Yu. A Chinese national, Zhang is accused of playing a pivotal role in the notorious Hafnium campaign, a massive cyberattack that targeted Microsoft Exchange servers worldwide, leading to widespread security vulnerabilities and the compromise of sensitive data across thousands of organizations.

The reward, issued through the State Department’s Rewards for Justice (RFJ) program, underscores the federal government’s persistent pursuit of actors involved in illicit digital operations directed by foreign intelligence services. The announcement, made on Wednesday, highlights a deepening legal and diplomatic struggle against state-backed hackers who have successfully breached critical infrastructure and research institutions within the United States.

A Coordinated Campaign of Espionage

According to official records, Zhang Yu is a director at the Shanghai Firetech Information Science and Technology Company. US authorities allege that in his professional capacity, he operated on behalf of the Shanghai State Security Bureau (SSSB), an arm of China’s Ministry of State Security (MSS). His activities are part of a broader, long-term pattern of state-sponsored digital intrusion aimed at stealing intellectual property, sensitive research, and classified government data.

Zhang’s alleged partner in these activities is Xu Zewei, who was previously a general manager at Shanghai Powerock Network Co. Ltd. The two were formally named in a nine-count indictment that was unsealed in July 2025. The legal proceedings against them followed a significant breakthrough in international cooperation: in April 2026, Xu was successfully extradited to the United States from Italy. His arrest in Milan, which took place at the specific request of US authorities, marked a major milestone in the FBI’s investigation into the group. Following his extradition, Xu was transported to the United States and has since appeared in a federal court in Houston, Texas, to face charges.

Zhang, however, remains at large, prompting the State Department to utilize the RFJ program as a tool to leverage public and international intelligence to facilitate his apprehension.

From COVID-19 Research to Exchange Server Exploitation

The charges against Zhang and Xu paint a picture of a calculated, multi-year campaign of cyberespionage. Investigators claim that starting in early 2020, the duo targeted critical sectors of the US economy and public health infrastructure. At the onset of the global pandemic, the hackers allegedly gained unauthorized access to COVID-19 research held by various US-based universities, as well as proprietary data belonging to leading immunologists and virologists. This effort to steal sensitive health and scientific information occurred while the world was racing to understand and mitigate the impact of the virus, highlighting the strategic value the hackers placed on the intellectual property of American academic and medical institutions.

The scope of their activities expanded significantly the following year. In 2021, Zhang and Xu were allegedly key figures in the exploitation of vulnerabilities within Microsoft Exchange Server—a campaign that became widely known as the "Hafnium" attacks. Microsoft, which now identifies the threat actor group as "Silk Typhoon," disclosed the discovery of these zero-day vulnerabilities in March 2021. The subsequent investigation revealed a global wave of compromises, with thousands of computer systems being infiltrated. Among the victims were not only educational institutions but also law firms and a wide array of private-sector entities.

When the FBI announced the extradition of Xu Zewei, officials revealed the staggering scale of the damage caused by the group. The investigation determined that the Hafnium campaign had successfully compromised more than 12,700 organizations within the United States alone. The sheer volume of these attacks turned the Hafnium incident into a watershed moment for cybersecurity awareness, forcing thousands of organizations to scramble to patch their systems and assess the extent of data theft that had occurred over months of unmonitored access.

Strategic Implications and the Rewards for Justice Program

The $10 million reward offered for information leading to Zhang Yu is issued under the authority of the Rewards for Justice program, which provides incentives for individuals who can offer actionable intelligence regarding those who target US critical infrastructure. Under the Computer Fraud and Abuse Act, targeting such infrastructure while acting under the direction or control of a foreign government constitutes a severe federal offense, justifying the substantial financial reward and the commitment of federal resources to the case.

The State Department’s involvement reflects a strategic shift in how the United States approaches cyber warfare. By offering significant financial incentives for information on specific individuals, the US is attempting to increase the personal and professional risks for those who facilitate state-sponsored hacking. This tactic is designed to create a sense of instability for the operators, making it more difficult for them to travel internationally or operate within their own networks without fear of being reported to authorities.

This latest action is consistent with the US government’s broader strategy of "naming and shaming" foreign actors involved in cyber-espionage. By filing formal indictments and utilizing the RFJ program, the US Justice Department and the State Department aim to expose the link between commercial entities—like the Shanghai Firetech Information Science and Technology Company—and the state intelligence apparatus of China. These revelations have contributed to a growing trend of military procurement bans and other sanctions imposed on Chinese cybersecurity firms that are suspected of providing the infrastructure or tools used by state-sponsored hacking groups.

As the case against the Hafnium operators continues to unfold in the American court system, the focus remains on holding the individuals behind the keyboard accountable. While Xu Zewei faces trial in Houston, the search for Zhang Yu persists. The US government remains steadfast in its position that the targeting of academic research and private-sector infrastructure, particularly during global health crises, will not go unanswered, and that international borders will not offer permanent refuge to those who facilitate such widespread digital disruption. The reward notice serves as a clear signal that the United States intends to pursue these actors until they are brought to justice, regardless of the complexity or the duration of the investigation.