The United States has announced a substantial reward of up to $10 million for information that leads to the arrest of Zhang Yu, a Chinese hacker accused of participating in a significant cyberattack on Microsoft Exchange servers. This initiative, led by the US Department of State, aims to bring to justice those involved in the Hafnium hacking campaign.
Background on the Cyberattack
The US State Department’s Rewards for Justice program publicized the reward on Wednesday, highlighting Zhang Yu’s alleged involvement. Zhang is believed to have collaborated with Xu Zewei, who was extradited from Italy to the United States in April 2026. The indictment, which was unveiled in July 2025, details the charges against both individuals.
Zhang Yu, previously a director at Shanghai Firetech Information Science and Technology Company, reportedly worked under the Shanghai State Security Bureau, part of China’s Ministry of State Security. His partner, Xu Zewei, held a managerial position at Shanghai Powerock Network Co. Ltd. Together, they are accused of illegally accessing sensitive COVID-19 research data produced by American universities and researchers.
The Hafnium Campaign
In 2021, Zhang and Xu allegedly exploited vulnerabilities within Microsoft Exchange Servers as part of the Hafnium campaign. This cyber operation reportedly compromised thousands of systems globally, with victims including a prominent US university and law firm. Microsoft initially revealed these breaches in March 2021, identifying the responsible group as Silk Typhoon.
The Federal Bureau of Investigation confirmed that by the time of Xu’s extradition, over 12,700 US organizations had been affected by this cyber intrusion. The Hafnium campaign is notable for its scale and the sensitive nature of the targeted information, emphasizing the importance of international cybersecurity cooperation.
Implications and Future Outlook
This reward offer is part of a broader strategy by the US government to protect critical infrastructure from foreign cyber threats, particularly those violating the Computer Fraud and Abuse Act. The emphasis on foreign government involvement underscores the geopolitical dimensions of cybersecurity threats.
The ongoing efforts to apprehend Zhang Yu highlight the US’s commitment to combating international cybercrime. As the digital landscape continues to evolve, the need for robust cybersecurity measures and international collaboration becomes increasingly crucial. Stakeholders worldwide are watching closely as developments unfold in this high-profile case.
