US seeks $10M reward for info on HAFNIUM hacker Zhang Yu

The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the 2021 Microsoft Exchange Server attacks known as HAFNIUM. Zhang remains at large, and the charges against him have not been tested in court. The reward is part of the Rewards for Justice program, which has paid over $250 million to informants since 1984. Zhang is accused of involvement in cyberattacks against U.S. critical infrastructure, including targeting COVID-19 research and exploiting Microsoft Exchange Server vulnerabilities. He is charged alongside Xu Zewei, who was arrested and extradited to the U.S. in April 2026. The indictment alleges that Zhang and Xu worked for Chinese government-affiliated companies, conducting hacking operations on behalf of the Shanghai State Security Bureau.