The US State Department is offering up to $10 million for information about Zhang Yu, a Chinese national accused of participating in the Hafnium campaign against Microsoft Exchange servers.
The State Department’s Rewards for Justice (RFJ) program announced the reward on Wednesday. Zhang is charged alongside Xu Zewei, who was extradited from Italy to the United States in April 2026.
According to RFJ, Zhang is a director at Shanghai Firetech Information Science and Technology Company. He was allegedly working on behalf of the Shanghai State Security Bureau (SSSB), part of China’s Ministry of State Security (MSS).
Zhang and Xu were named in a nine-count Accusation unsealed in July 2025, a few days after Italian police arrested Xu in Milan at the request of the United States. Xu has since appeared in federal court in Houston, while Zhang remains at large.
“In early 2020, Zhang and his partner Xu Zewei, then general manager at Shanghai Powerock Network Co. Ltd., gained unauthorized access to COVID-19 research from U.S. universities and leading immunologists and virologists to steal sensitive information,” RFJ said.
The following year, the two allegedly exploited vulnerabilities in Microsoft Exchange Server as part of Hafnium. RFJ says the campaign compromised thousands of computers worldwide and that victims included a US university and a US law firm.
Microsoft disclosed the Hafnium attacks in March 2021 and now identifies the threat actor as Silk Typhoon. When Xu was extradited, the FBI said the campaign had compromised more than 12,700 U.S. organizations.
The reward falls under an RFJ offer for information on anyone targeting critical U.S. infrastructure in violation of the Computer Fraud and Abuse Act while acting at the direction or under the control of a foreign government.
Related: US charges 17 Iranian hackers and offers $10 million reward for five of them
Related: China’s leading cybersecurity firms are hit by increasing military procurement bans
Related: Report links Chinese companies to tools used by state-sponsored hackers
