U.S. Offers $10 Million Reward for Chinese Hacker Who Tried to Steal COVID-19 Research
The U.S. offers up to $10 million for Zhang Yu, accused of MSS-directed theft of COVID-19 research.
The U.S. State Department's Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a Chinese national accused of supporting intrusions against American COVID-19 research. Prosecutors say Zhang worked for the Shanghai State Security Bureau, part of China's Ministry of State Security, and that alleged partner Xu Zewei obtained researcher mailbox contents after breaching a Texas-area university between February 2020 and June 2021. The case also ties both men to the HAFNIUM Microsoft Exchange campaign, which the FBI says compromised more than 12,700 U.S. organizations; attackers allegedly installed web shells and searched a law firm's mail for terms including "MSS" and "Hong Kong." Italian authorities arrested Xu in July 2025 and he was extradited in April 2026, while Zhang remains at large under a nine-count indictment.