U.S. Offers $10 Million Reward for Alleged Hafnium Hacker

Summary

The U.S. State Department is offering up to $10 million for information on Zhang Yu, accused of working with Hafnium operators to target COVID-19 research and exploit Microsoft Exchange vulnerabilities.

Key points

Zhang Yu, a Chinese national, was named in a nine-count indictment unsealed in July 2025 and remains at large.
The State Department says Zhang allegedly worked on behalf of China’s Shanghai State Security Bureau.
Zhang and co-defendant Xu Zewei are accused of stealing information from U.S. COVID-19 researchers starting in early 2020.
The pair allegedly exploited Microsoft Exchange Server vulnerabilities in 2021 as part of the Hafnium campaign.
The FBI said the campaign compromised more than 12,700 U.S. organizations; Xu was extradited from Italy in April 2026.

Article Details

Event Type: US reward offer for information on Zhang Yu, who is accused of participating in the Hafnium campaign targeting Microsoft Exchange servers.
Impact: RFJ says the campaign compromised thousands of computers worldwide; the FBI said it compromised more than 12,700 US organizations. Alleged victims included a US university and a US law firm, and the accused also allegedly accessed COVID-19 research at US-based universities.