As reported by Security Affairs, the U.S. State Department announced a reward of up to $10 million for information leading to the arrest of Zhang Yu, who is accused of being a key figure in the HAFNIUM cyberattack campaign.
Zhang Yu, a director at Shanghai Firetech Information Science and Technology, is alleged to have supervised employees involved in cyberattacks and worked with Xu Zewei, another accused hacker. Both men reportedly operated under China’s Ministry of State Security. The indictment details two major hacking campaigns: one in early 2020 targeting U.S. universities and scientists working on COVID-19 research, and another later that year exploiting vulnerabilities in Microsoft Exchange Server, known as HAFNIUM. This latter campaign compromised over 12,700 U.S. organizations. The FBI estimates the scale of the HAFNIUM attacks, which targeted entities including Texas universities and an international law firm. Xu Zewei was arrested in Milan in July 2025 and extradited to the U.S. The Rewards for Justice program, which offers financial incentives for information protecting U.S. national security, has paid out over $250 million since 1984, expanding its scope to include malicious cyber activity.
Source: Security Affairs
