The US Department of State is offering a substantial reward for information leading to the capture of Zhang Yu, a Chinese national accused of being part of a notorious hacking campaign that targeted Microsoft Exchange servers. The Hafnium attacks, which began in 2020, compromised thousands of computers worldwide, including those belonging to a US university and a law firm.
According to the State Department’s Rewards for Justice (RFJ) program, Zhang is a director at Shanghai Firetech Information Science and Technology Company and allegedly worked on behalf of the Shanghai State Security Bureau, part of China’s Ministry of State Security. He is accused of participating in the Hafnium campaign alongside Xu Zewei, who was extradited from Italy to the US in April 2026.
The Hafnium attacks exploited vulnerabilities in Microsoft Exchange Server, a popular email server software used by many organizations worldwide. The hackers gained unauthorized access to sensitive information, including COVID-19 research conducted by US-based universities and leading immunologists and virologists. Microsoft disclosed the attacks in March 2021 and now tracks the threat actor as “Silk Typhoon”.
The reward of up to $10 million is part of an RFJ offer for information on anyone who targets US critical infrastructure in violation of the Computer Fraud and Abuse Act while acting at the direction or under the control of a foreign government. This offer highlights the ongoing efforts by governments around the world to combat state-sponsored hacking and protect national security.
The Hafnium attacks had significant consequences, compromising more than 12,700 US organizations, according to the FBI. The attacks also raised concerns about the potential for sensitive information to be stolen or manipulated by hackers. The fact that Zhang remains at large underscores the challenges faced by law enforcement agencies in tracking down and apprehending state-sponsored hackers.
The reward offer is a clear message from the US government that it will not tolerate hacking activities that threaten national security. It also serves as a reminder for organizations worldwide to prioritize cybersecurity measures, including regular software updates and penetration testing, to prevent similar attacks in the future.
For individuals who may have information about Zhang’s whereabouts or involvement in the Hafnium campaign, this reward offer presents an opportunity to come forward and potentially help bring an end to his alleged hacking activities.
Source: SecurityWeek — 2026-10-08