U.S. OFFERS UP TO $10 MILLION FOR INFORMATION ON ACCUSED CHINESE HAFNIUM HACKER LINKED TO GLOBAL MICROSOFT EXCHANGE INTRUSIONS

WASHINGTON — The U.S. State Department’s Rewards for Justice program is offering a reward of up to $10 million for information leading to the identification or location of individuals acting at the direction or under the control of a foreign government who participate in malicious cyber activity against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.

The current reward effort specifically seeks information concerning Zhang Yu, a Chinese national accused by U.S. authorities of participating in cyber operations connected to the People’s Republic of China’s Ministry of State Security and the Shanghai State Security Bureau.

Zhang is identified by the U.S. government as a director of Shanghai Firetech Information Science and Technology Company Ltd. Authorities allege he worked at the direction of the Shanghai State Security Bureau, an arm of China’s Ministry of State Security responsible for intelligence, counterintelligence and domestic security functions.

The case places Zhang within a broader pattern repeatedly identified by U.S. authorities in which private Chinese companies and contractors allegedly conduct cyber operations on behalf of the Chinese government. According to the Rewards for Justice program, this arrangement can allow state-directed activity to be carried out through commercial entities while obscuring the government’s direct role.

Federal authorities allege Zhang worked with Xu Zewei, who previously served as general manager of Shanghai Powerock Network Co. Ltd.

Beginning in early 2020, Zhang and Xu allegedly gained unauthorized access to research conducted by U.S. universities and prominent immunologists and virologists studying COVID-19. Authorities contend the objective was to steal sensitive research information during a period when governments, universities and pharmaceutical researchers around the world were racing to understand the virus and develop vaccines, treatments and other countermeasures.

The alleged targeting of COVID-19 research placed universities and scientific institutions directly inside a state-linked cyber intelligence campaign at a time when medical research carried significant strategic and economic value.

Beginning in late 2020 and continuing into 2021, U.S. authorities allege Zhang and Xu participated in a much larger cyber campaign involving vulnerabilities in Microsoft Exchange Server, software widely used by organizations to manage email and related communications.

That campaign became publicly known as HAFNIUM.

The HAFNIUM intrusions exploited vulnerabilities in Microsoft Exchange Server installations and compromised thousands of computers around the world. U.S. victims identified in the government’s case included a university and a law firm, illustrating that the campaign was not confined to government networks or traditional defense targets.

Microsoft Exchange Server occupies a particularly sensitive position inside organizational networks because it handles email communications and can provide attackers with access to messages, credentials and internal systems. Successful exploitation can therefore provide an entry point into wider corporate, academic or government environments.

The scale of the HAFNIUM campaign made it one of the most consequential state-linked Exchange Server intrusion operations disclosed in recent years. The campaign demonstrated how a vulnerability affecting widely deployed enterprise software could be used against thousands of organizations before systems were fully patched or compromised infrastructure was removed.

U.S. authorities have accused the Chinese government of relying on contractors and private companies to conduct cyber operations that serve intelligence objectives while maintaining separation between the operators and formal government agencies.

Rewards for Justice states that the PRC uses an extensive network of private firms and contractors to steal information while making direct attribution to the Chinese government more difficult.

That model can complicate cyber investigations because individuals involved may hold commercial positions while allegedly conducting work for state intelligence services. Investigators must therefore establish both the technical activity and the relationship between the operators, private companies and government agencies directing or benefiting from the operations.

Xu Zewei was arrested by Italian authorities and later extradited to the United States in April 2026, placing one of Zhang’s alleged partners inside the U.S. federal court system.

Zhang remains at large.

The reward does not itself represent a conviction or establish Zhang’s guilt. It is intended to generate information that could help U.S. authorities identify, locate or apprehend individuals accused of conducting foreign-government-directed cyber activity against American interests.

The Rewards for Justice program has become one of the federal government’s tools for pursuing cyber actors operating outside the United States, particularly when conventional law-enforcement methods are limited by geography, foreign jurisdiction or the protection allegedly provided by another government.

The program’s cyber reward authority covers individuals who act at the direction or under the control of foreign governments and participate in malicious cyber activity targeting U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.

That federal statute is one of the primary criminal laws used in cases involving unauthorized access to protected computers, theft of information, network intrusion and other forms of computer-related crime.

The allegations against Zhang also illustrate the overlap between traditional espionage and modern cyber operations. Intelligence collection that once required physical access, recruited sources or covert surveillance can now be conducted remotely against universities, companies, research institutions and government systems thousands of miles away.

The COVID-19 research intrusions and HAFNIUM campaign represent two different strategic targets but share the same underlying concern: unauthorized access to sensitive American information allegedly carried out for the benefit of a foreign intelligence service.

The first involved scientific and medical research. The second involved mass exploitation of widely used enterprise software capable of opening access to organizations across multiple industries.

The U.S. government has not announced Zhang’s capture, and he remains wanted in connection with the alleged activity.

The government’s allegations remain accusations that would have to be proven beyond a reasonable doubt in court. The $10 million reward is aimed at obtaining information that could help authorities locate Zhang or identify others acting under foreign-government direction in malicious cyber operations against the United States.

---

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---