U.S. Offer Up to $10 Million for Information on Zhang Yu
The Rewards for Justice program has announced a reward of up to $10 million for information leading to the identification or location of Zhang Yu, who is charged in the United States in connection with activities linked to the HAFNIUM campaign.
The reward for Zhang Yu is up to $10 million, according to the U.S. Rewards for Justice program. The program is seeking information that could lead to the identification or location of the Chinese national, whom U.S. authorities link to malicious cyber activities and the mass HAFNIUM campaign against Microsoft Exchange servers.
Rewards for Justice states that Zhang Yu is the director of Shanghai Firetech Information Science and Technology Company, Ltd. U.S. authorities are seeking him in a criminal case in which he and Xu Zewei are charged in a nine-count indictment. The indictment was unsealed on July 8, 2025, and concerns alleged intrusions from February 2020 through June 2021.
The reward for Zhang Yu follows the indictment
The U.S. Department of Justice said that, following his extradition from Italy, Xu Zewei appeared before a federal court in Houston on April 27, 2026. According to the department, Zhang Yu remains at large. His current whereabouts have not been publicly confirmed.
The reward announcement is therefore aimed at obtaining information about the defendant, not announcing a new technical incident. The announcement does not state whether the reward will produce information leading to Zhang’s arrest.
In connection with the case, U.S. authorities allege that the defendants participated in cyber activities also targeting COVID-19 research. Claims that Zhang acted at the direction of China’s Ministry of State Security and its Shanghai State Security Bureau are allegations by U.S. authorities. The court has not yet legally established them.
Link to the HAFNIUM campaign
U.S. authorities link the conduct described in the indictment to the mass HAFNIUM campaign against Microsoft Exchange Server.
However, labeling Zhang Yu a “HAFNIUM hacker” oversimplifies the legal status of the case. Zhang is charged in a case that the United States links to the campaign, but he has not been convicted.
The current Rewards for Justice announcement provides no information about a new vulnerability, active exploitation, or new indicators of compromise. It contains no new specific technical recommendations for system administrators; this is not a new security warning.
What to watch next
Further developments may include confirmation of Zhang Yu’s location or arrest, as well as procedural steps in the U.S. case against Xu Zewei and the other defendants. New court documents or official materials could add technical details and evidence concerning the attacks covered by the indictment.
Sources
- Rewards for Justice – Confirms the current reward of up to $10 million and states that the program is seeking information about Zhang Yu.
- U.S. Department of Justice – Documents the indictment against Xu Zewei and Zhang Yu, its time period, and U.S. claims about links to HAFNIUM.
- U.S. Department of Justice – Confirms Xu Zewei’s extradition to the United States in April 2026 and that Zhang Yu remains at large, according to the department.
- The Record – Independently confirms the reward announcement and the case’s context.
Verified and updated: 10/08/2026 15:19
