Zhang Yu Sssb

Rewards for Justice (RFJ) is offering a reward of up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.

Under this reward offer, RFJ seeks information on Zhang Yu, a Chinese national and director at Shanghai Firetech Information Science and Technology Company, Ltd. working at the behest of the People’s Republic of China (PRC) Ministry of State Security (MSS) Shanghai State Security Bureau (SSSB). The MSS and SSSB are PRC intelligence services responsible for the country domestic counterintelligence, non-military foreign intelligence, and aspects of the PRC’s political and domestic security.

Starting in early 2020, Zhang and his partner Xu Zewei, then a general manager at Shanghai Powerock Network Co. Ltd., gained unauthorized access to COVID-19 research conducted by U.S.-based universities and leading immunologists and virologists to steal sensitive information.

The following year, Zhang and Xu exploited vulnerabilities in computers running Microsoft Exchange Server, a computer program involved in the storage and retrieval of e-mails. Those intrusions were part of mass intrusion campaign, publicly known as HAFNIUM, which compromised thousands of computers worldwide. Among the victims were a university and a law firm, both based in the United States. Xu was arrested by Italian law enforcement and extradited to the United States in April 2026. Zhang remains at large.

The PRC uses an extensive network of private companies and contractors in China to hack and steal information in a manner that obscures the PRC government’s involvement.

Do your part. Secure a safer world and a brighter future. Click to learn Rewards for Justice’s tip reporting options.