U.S. Offers Up to $10 Million for Information on Man Charged in HAFNIUM Attacks
Summary
The State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, who is charged in the U.S. over alleged cyberattacks including the 2021 HAFNIUM Microsoft Exchange campaign.
Key points
- Zhang Yu remains at large; U.S. authorities say he and Xu Zewei were charged together in a nine-count indictment. The charges have not been tested in court.
- The alleged hacking occurred from February 2020 to June 2021 and included attacks on U.S. universities and COVID-19 researchers.
- The indictment alleges the defendants exploited Microsoft Exchange Server flaws in the campaign later known as HAFNIUM.
- Microsoft disclosed the Exchange attacks in March 2021 and released fixes for four zero-day flaws, including ProxyLogon.
- The FBI says the HAFNIUM campaign compromised more than 12,700 U.S. organizations.
- Xu was arrested in Italy in July 2025 and extradited to the U.S. in April 2026.
Article Details
- Event Type
- The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, who has been charged in connection with alleged cyberattacks.
- Impact
- U.S. authorities allege the attacks targeted universities, scientists working on COVID-19 research, and other organizations. The FBI says the broader HAFNIUM campaign compromised more than 12,700 U.S. organizations. Zhang remains at large, and the charges against him have not been tested in court.
People
Brett LeathermanFBI Cyber Division assistant director quoted commenting on contractors allegedly used by the Chinese government in cyber operations.Xu ZeweiCharged alongside Zhang Yu; arrested in Milan in July 2025 and extradited to the United States in April 2026.Zhang YuChinese national charged in the United States over an alleged role in the attacks; remains at large, according to U.S. authorities.
Threat Actors
Vendors
Products
Countries
Chinahacking by other Firetech staff, and coordinated the hacking with Xu. The bureau is a branch of China's Ministry of State Security (MSS), an intelligence service.ItalyXu was arrested in Milan in July 2025 at the request of the United States, and Italy extradited him to the United States in April 2026.United Statesinformation leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM.