US Offers $10 Million Reward for Chinese Hacker Linked to COVID-19 Research Attacks

• •The U.S. offers a $10 million reward for information on Zhang Yu, a Chinese hacker.
• •Zhang is accused of targeting COVID-19 research through state-sponsored cyberattacks.
• •The HAFNIUM campaign compromised thousands of computers globally, exploiting Microsoft Exchange vulnerabilities.

The U.S. State Department has announced a reward of up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national accused of cyberattacks targeting U.S. COVID-19 researchers. Zhang is alleged to have worked with Xu Zewei and others under the direction of China's Ministry of State Security (MSS), conducting intrusions between February 2020 and June 2021. These attacks were part of the HAFNIUM campaign, which exploited vulnerabilities in Microsoft Exchange Server and compromised thousands of computers worldwide. The hackers targeted U.S.-based universities and organizations involved in COVID-19 research, stealing sensitive information. Xu was arrested in Italy in July 2025 and extradited to the U.S. in April 2026, facing multiple charges. Zhang remains at large, and the U.S. government is actively seeking information about him and his associates.