US Rewards for Justice offers up to US$10 million for Zhang Yu, alleged Shanghai State Security Bureau contractor accused with Xu Zewei of COVID-19 research theft and HAFNIUM Exchange intrusions
The US State Department's Rewards for Justice (RFJ) programme is offering up to US$10 million for information on Zhang Yu, a Chinese national it describes as a director at Shanghai Firetech Information Science and Technology Company working at the direction of China's Ministry of State Security Shanghai State Security Bureau. RFJ says that from early 2020 Zhang and his partner Xu Zewei, then general manager at Shanghai Powerock Network, gained unauthorised access to COVID-19 research at US universities and stole information from immunologists and virologists, and that in 2021 the pair exploited Microsoft Exchange Server flaws as part of the HAFNIUM mass-intrusion campaign, with victims including a US university and a law firm. Xu was arrested in Italy and extradited to the US in April 2026; Zhang remains at large. Cybersecurity News reported the offer on 8 October, citing the FBI Cyber Division; the RFJ page itself carries no date. The charges are allegations, not proof of guilt. Primary: Rewards for Justice.
- Product
- n/a (law-enforcement action — MSS Shanghai State Security Bureau contractors; HAFNIUM Microsoft Exchange campaign)
- Versions
- n/a
- Exploited in Australia?
- unknown
- Patch to
- n/a — reward offer. Universities and medical research groups: the HAFNIUM-era Exchange flaws were patched in 2021, so retire any on-premises Exchange still unpatched or out of support, and keep phishing-resistant MFA and mailbox-access auditing on researcher accounts.
Primary: Rewards for Justice — Zhang Yu (SSSB) (undated reward page, reported 8 Oct 2026) · Vendor: US Department of Justice — Prolific Chinese state-sponsored contract hacker extradited from Italy · Cybersecurity News — US offers $10 million reward for Chinese hacker who tried to steal COVID-19 research (8 Oct 2026)