US offers up to $10 million for alleged Hafnium hacker Zhang Yu
The State Department's Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a director at Shanghai Firetech accused of hacking for China's Ministry of State Security. Prosecutors say he and Xu Zewei stole COVID-19 research from US universities in 2020 and then joined the 2021 Hafnium campaign against Microsoft Exchange servers. Xu was extradited from Italy in April; Zhang remains at large.
The State Department's Rewards for Justice program is seeking information on Zhang Yu, a Chinese national and director at Shanghai Firetech Information Science and Technology Company. US authorities say he worked at the direction of the Shanghai State Security Bureau, part of China's Ministry of State Security. The reward of up to $10 million falls under RFJ's standing offer for information on people who attack US critical infrastructure on behalf of a foreign government.
According to RFJ, starting in early 2020 Zhang and his partner Xu Zewei, then a general manager at Shanghai Powerock Network, broke into COVID-19 research at US universities and stole information from leading immunologists and virologists. The following year they exploited Microsoft Exchange Server vulnerabilities as part of Hafnium, the mass intrusion campaign that compromised thousands of computers worldwide; victims included a US university and a US law firm.
Both men were named in a nine-count indictment unsealed in July 2025, days after Italian police arrested Xu in Milan at US request. Xu was extradited to the United States in April 2026; Zhang remains at large. The FBI's Houston Field Office is investigating.