U.S. Offers $10 Million Reward for Alleged HAFNIUM Hacker Zhang Yu
The United States offered $10 million for Zhang Yu, accused of helping run the HAFNIUM Exchange intrusions.
The U.S. State Department’s Rewards for Justice program is offering up to $10 million for information leading to Zhang Yu, a director at Shanghai Firetech. Prosecutors allege he directed employees, including Xu Zewei, in operations for China’s Ministry of State Security in Shanghai, covering 2020 theft of U.S. COVID-19 research and the HAFNIUM intrusions against Microsoft Exchange Server. The FBI says that Exchange campaign compromised more than 12,700 U.S. organizations. Xu was arrested at Milan Malpensa Airport on July 3, 2025, and later extradited; Zhang remains at large and the charges are untested.
63