U.S. offers up to $10 million for tips on Zhang Yu, charged in HAFNIUM Exchange hacks

The State Department's Rewards for Justice program is offering up to $10 million for information that identifies or locates Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. He has not been arrested.

The U.S. State Department is offering up to $10 million for tips that identify or locate Zhang Yu, a Chinese national charged in a Houston federal court over the 2021 Microsoft Exchange Server attacks known as HAFNIUM. Zhang has not been arrested. The nine-count indictment against him remains untested in court.

The reward notice comes from the department's Rewards for Justice program , the government's national security tip program. The program says it has paid more than $250 million to over 125 people since 1984. A notice quoted this week by the news outlet NTD asks for information leading to Zhang's "identification or location" in connection with "malicious cyber activities against U.S. critical infrastructure."

The dollar amount and that wording match a January 2025 Rewards for Justice offer. That offer covered information on anyone who hacks U.S. critical infrastructure at the direction of a foreign government.

The charges against Zhang Yu

Federal prosecutors in Houston indicted Zhang and a second man, Xu Zewei, in November 2023. The indictment became public in July 2025. The Justice Department has since asked the public for help finding Zhang.

The indictment covers hacking that allegedly took place between February 2020 and June 2021. Authorities describe Zhang as a director at Shanghai Firetech Information Science and Technology. According to the indictment, he took tasks from the Shanghai State Security Bureau, supervised hacking by other Firetech staff, and coordinated the work with Xu. The Shanghai State Security Bureau operates as a branch of China's Ministry of State Security, the country's intelligence service.

Xu worked for Shanghai Powerock Network. The Justice Department calls Powerock one of many enabling companies that hacked for the Chinese government. Prosecutors say China uses private firms and contractors to hide its role in cyber operations.

Xu was arrested in Milan in July 2025 at the request of the United States. Italy extradited him to the United States in April 2026.

Assistant Director Brett Leatherman of the FBI's Cyber Division described the contractor model at the time of Xu's arrest. Xu, he said, "is one of many contractors the Chinese government uses to obscure its hand in cyber operations, and others who do the same face the same risk."

Two waves of intrusions

The indictment alleges two separate waves of intrusions.

The first hit in early 2020. Targets included U.S. universities and scientists working on COVID-19 vaccines, treatment, and testing. On or Jan. 30, 2021, Xu allegedly told Zhang he had compromised a Texas university's network. The alleged victims include two Texas universities and an international law firm with an office in Washington, D.C.

The second wave began in late 2020 and exploited flaws in Microsoft Exchange Server. Microsoft disclosed the attacks on March 2, 2021 and released fixes for four zero-day flaws, including ProxyLogon. Microsoft blamed HAFNIUM, which it described as "a group assessed to be state- and operating out of China." Microsoft now tracks the group as Silk Typhoon. Microsoft's announcement of the HAFNIUM campaign lays out the initial findings.

Other hacking groups started using the same flaws within days of the disclosure. The FBI says the HAFNIUM campaign as a whole compromised more than 12,700 U.S. organizations. In July 2021, the United States and partner governments said hackers linked to the Ministry of State Security carried out the campaign.

What defenders should do now

The case adds another public data point to a campaign that already changed how many organizations handle Exchange patching. Several practical steps follow from the record.

Review current Exchange security updates. If your organization runs Exchange Server on-premises or in a hybrid setup, the four zero-days disclosed in March 2021 are the starting point for any patch review. CISA's joint advisory on the Microsoft Exchange compromises still lists the indicators and mitigations defenders used at the time.

Hunt for infrastructure tied to HAFNIUM and Silk Typhoon. The FBI's cyber wanted list tracks state-backed actors, and Microsoft's threat intelligence team publishes ongoing coverage of Silk Typhoon. Watch for webshells on Exchange servers, unusual Outlook Web Access authentication patterns, and lateral movement that starts from mail infrastructure.

Treat third-party access as part of the attack surface. The indictment's account of Firetech and Powerock shows how a government can route operations through private firms. Document who holds remote access to your network, what those accounts can reach, and how you would revoke them.

Use reward programs as a source of investigative leads. The $10 million figure puts a price on identifying a single actor. Anyone with firsthand knowledge of Zhang's location can submit a tip through the State Department's Rewards for Justice program.

What is still unresolved

Zhang has not been arrested. U.S. authorities say he remains at large. The charges against him have not been tested in court, so the government's account of the hacking remains allegations.

The January 2025 version of the reward offer covered a broader category: anyone who hacks U.S. critical infrastructure at the direction of a foreign government. The new notice names Zhang. Investigators now have a specific person they want the public to help locate.

Source : thehackernews.com