THE U.S. State Department has offered up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The reward, issued through the Rewards for Justice programme, mirrors a January 2025 offer for information on anyone hacking U.S. critical infrastructure at the direction of a foreign government. Zhang remains at large, and the charges against him have not been tested in court.
The indictment, filed in Houston, lists nine counts and ties Zhang to work as a director at Shanghai Firetech Information Science and Technology, with tasks supervised by the Shanghai State Security Bureau and coordination with Xu Zewei. Xu was arrested in Milan in July 2025 and extradited to the United States in April 2026; authorities describe him as one of many contractors used by the Chinese government to obscure its hand in cyber operations.
The HAFNIUM campaign, disclosed by Microsoft in March 2021, involved exploiting four zero-days in Microsoft Exchange Server, including ProxyLogon, and targeted U.S. universities, researchers working on COVID-19 efforts, and an international law firm. The FBI has previously said the campaign compromised more than 12,700 U.S. organisations. The Justice Department has urged the public for information on Zhang’s whereabouts.