US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward

Zhang Yu, a Chinese national and director at Shanghai Firetech Information Science and Technology Company, is wanted by the US for his alleged role in the Hafnium cyber espionage campaign. This campaign, tracked by Microsoft as Silk Typhoon, exploited vulnerabilities in Microsoft Exchange Server starting in 2021 to compromise over 12,700 US organizations and thousands globally. Zhang and his partner Xu Zewei also allegedly accessed sensitive COVID-19 research data from US universities and leading scientists beginning in early 2020. Xu was extradited from Italy to the US in April 2026 and charged alongside Zhang in a nine-count indictment unsealed in July 2025. The US Department of State’s Rewards for Justice program is offering up to $10 million for information leading to Zhang’s capture. The campaign targeted US critical infrastructure and violated the Computer Fraud and Abuse Act while acting under direction of the Chinese Ministry of State Security.

The Hafnium campaign compromised thousands of computers worldwide, including over 12,700 US organizations such as universities and law firms. Sensitive COVID-19 research data from US-based institutions was accessed without authorization. The campaign represents a significant breach of US critical infrastructure and intellectual property, with implications for national security and public health research confidentiality.

This report does not provide specific remediation or patch information. Microsoft disclosed the Hafnium attacks in March 2021 and has since released patches for the exploited Microsoft Exchange Server vulnerabilities. Organizations should ensure their Microsoft Exchange servers are fully patched with the latest security updates. The US Department of State is actively seeking information on Zhang Yu and offers a reward for assistance. No additional mitigation guidance is provided in this report.