US Offers $10m Reward For Chinese Hacker Accused Of Targeting COVID-19 Researchers

The reward is being offered through the State Department’s Rewards for Justice (RFJ) programme, which is seeking information on Zhang, his associates and their alleged cyber activities.

The United States Department of State has announced a reward of up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national accused of working with China’s Ministry of State Security (MSS) to conduct malicious cyber activities targeting U.S. institutions.

The reward is being offered through the State Department’s Rewards for Justice (RFJ) programme, which is seeking information on Zhang, his associates and their alleged cyber activities.

According to U.S. authorities, Zhang worked with Xu Zewei and others in a hacking operation directed by officers of the MSS’s Shanghai State Security Bureau (SSSB).

The alleged activities included targeting U.S.-based universities, immunologists and virologists conducting research into COVID-19 vaccines, treatments and testing during the height of the pandemic.

The U.S. Department of Justice said Xu and his co-conspirators carried out computer intrusions between February 2020 and June 2021.

Court documents allege that officers of the Chinese intelligence service directed the hackers to gain unauthorised access to computer systems and specific email accounts belonging to researchers.

The U.S. government has also linked the pair to the HAFNIUM cyber intrusion campaign, which authorities said compromised thousands of computers worldwide.

In one example cited in the indictment, Xu allegedly confirmed to an MSS officer in February 2020 that he had compromised the network of a U.S. research university.

The officer subsequently directed him to target email accounts belonging to virologists and immunologists involved in COVID-19 research.

Zhang, 44, remains at large, according to the U.S. Department of Justice.

His alleged co-conspirator, Xu, was arrested in Milan, Italy, in July 2025 at the request of the United States after arriving from China. He was later extradited to the U.S. in April 2026 and appeared before a federal court in Houston.

Xu faces a nine-count indictment over alleged computer intrusions, wire fraud, unauthorised access to protected computers, intentional damage to protected computers and aggravated identity theft.

The Justice Department said the charges relate to activities targeting U.S. universities and other organisations, including the theft of COVID-19 research and information from computer systems.

The FBI has described HAFNIUM as a large-scale intrusion campaign and said the activities were directed by China's Ministry of State Security.