US offers $10M reward for Chinese national Zhang Yu over HAFNIUM hacking
The State Department is seeking information on Zhang Yu, charged in the HAFNIUM Exchange Server campaign, as Xu Zewei faces court in Houston.
The US Department of State has offered a reward of up to $10 million for information on the identity or location of Zhang Yu, a Chinese national charged in connection with the HAFNIUM Microsoft Exchange Server hacking campaign, the department said. The reward falls under the department's Rewards for Justice program.
Zhang Yu is charged with intrusions targeting US universities researching COVID-19 and with exploiting Exchange Server vulnerabilities. He has not been arrested. US prosecutors identify him as a director of Shanghai-based Firetech, acting under the direction of the Shanghai State Security Bureau under China's Ministry of State Security.
Xu Zewei, accused of coordinating attacks with Zhang Yu, worked at Shanghai Powerock Network at the time of the attacks. He was arrested in Milan, Italy, in July 2025 at the request of the United States and was extradited to the US in April, appearing in federal court in Houston.
An indictment naming both men containing nine counts was written in November 2023 and unsealed in July 2025.
Background
In 2021, Microsoft disclosed the HAFNIUM campaign and released security updates for four Exchange Server vulnerabilities on March 2, 2021. Microsoft attributed the attacks to a China-based state-sponsored hacking group, now tracked as Silk Typhoon. The vulnerabilities affected on-premises Exchange Server, while Exchange Online was not affected. The FBI said more than 12,700 US organizations were compromised. In April 2021, the FBI obtained court authorization to copy and remove specific web shells from hundreds of servers in the US.
Quick answers
Who is Zhang Yu?
Zhang Yu is a Chinese national charged in connection with the HAFNIUM Microsoft Exchange Server hacking campaign, identified by US prosecutors as a director of Shanghai-based Firetech.
What is the reward for information on Zhang Yu?
The US Department of State is offering up to $10 million for information on his identity or location through the Rewards for Justice program.
What happened to Xu Zewei?
Xu Zewei was arrested in Milan, Italy, in July 2025 at the request of the United States, extradited to the US in April, and appeared in federal court in Houston.