U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
Summary: The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged over the 2021 HAFNIUM Microsoft Exchange Server attacks and still at large. Zhang, described in the indictment as a director at Shanghai Firetech Information Science and Technology who worked on tasks assigned by the Shanghai State Security Bureau, is charged alongside Xu Zewei in a nine-count indictment from November 2023 made public in July 2025; Xu was arrested in Milan in July 2025 and extradited from Italy in April 2026.
Key Takeaway: The FBI says the HAFNIUM campaign compromised more than 12,700 U.S. organizations, and the alleged intrusions ran from COVID-19 vaccine research at U.S. universities to the Exchange zero-days Microsoft disclosed on March 2, 2021. One charged operator is in U.S. custody and the other is the subject of a $10 million reward, which is the practical limit of consequence when the work is routed through contractors at companies like Firetech and Powerock.
Read the original at The Hacker News ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026