United States Offers Reward of Up to $10 Million for Information on Suspect in Hafnium Campaign
The U.S. Department of State has offered a reward of up to $10 million for information leading to the whereabouts of Zhang Yu, who is accused of participating in the Hafnium campaign that exploited Microsoft Exchange vulnerabilities and compromised thousands of devices worldwide.
The U.S. Department of State announced a reward of up to $10 million for information about Zhang Yu, a Chinese national whom authorities accuse of participating in the Hafnium campaign targeting Microsoft Exchange servers, while the suspect remains out of the authorities’ reach.
The announcement was made through the Rewards for Justice program, which offers rewards for information about individuals who attack U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act when they conduct their operations at the direction or under the control of a foreign government.
Charges Linked to Extensive Breaches
Zhang was charged alongside Xu Zewei in a nine-count indictment unsealed in July 2025. U.S. authorities say that, beginning in early 2020, the two men gained unauthorized access to research related to the COVID-19 pandemic held by U.S. universities and immunology and virology researchers, with the aim of stealing sensitive information.
According to the U.S. program, Zhang was a manager at Shanghai Firetech Information Science and Technology Company and allegedly worked for the Shanghai State Security Bureau, which is affiliated with China’s Ministry of State Security. The charges also stated that Xu was then the general manager of Shanghai Powerock Network Co. Ltd.
The following year, the two men were accused of exploiting vulnerabilities in Microsoft Exchange as part of the Hafnium campaign. Authorities said the campaign affected thousands of computers worldwide, including a U.S. university and a U.S. law firm among its victims.
Why Does This News Matter?
The new reward shows that the case is not limited to a technical characterization of a past hacking campaign, but has moved to the stage of an international criminal pursuit targeting an individual believed to have played a direct role in an operation that affected a large number of organizations. Microsoft disclosed the Hafnium attacks in March 2021, and the group is currently tracked under the name Silk Typhoon.
According to the U.S. Federal Bureau of Investigation, the campaign compromised more than 12,700 organizations in the United States. This gives the case practical importance for security teams, because exploiting enterprise email servers can provide a path to communications data and internal files, even when the server itself is not the operation’s ultimate target.
Case Developments
Italian police arrested Xu in Milan at the request of the United States before extraditing him to the United States in April 2026. Xu later appeared before a federal court in Houston, while Zhang remains at large. The reward offer alone does not establish the charges against Zhang, as the accusations remain subject to trial proceedings.