US offers $10 million for Chinese national linked to Hafnium hacker group

The US State Department is offering a bounty of up to $10 million for information regarding the location of Zhang Yu, a 44-year-old Chinese national. According to the announcement on the Rewards for Justice website, authorities accuse Zhang of being a central operator within the state-sponsored hacking group known as Hafnium, which also operates under the alias Silk Typhoon.

Zhang Yu is identified in the bounty notice as a director at Shanghai Firetech Information Science and Technology. The US government states that he works under the direction of the Shanghai State Security Bureau, an agency within China’s Ministry of State Security. US officials allege that Beijing utilizes private entities like Shanghai Firetech and Shanghai Powerock Network to conduct espionage while masking state involvement in these cyber operations.

Charges and Alleged Activities

Zhang Yu faces charges alongside Xu Zewei, a 34-year-old national, for engaging in malicious cyber activity against US computer systems. The alleged crimes span from February 2020 through June 2021. According to the bounty details, the pair reportedly stole sensitive data from the email accounts of immunologists, virologists, and US universities during the early part of this period. This stolen information reportedly included research related to COVID-19 vaccines, allegedly at the behest of the Chinese government.

In the following year, the duo is accused of exploiting vulnerabilities in Microsoft Exchange Server to exfiltrate additional data. Once these flaws became public knowledge, hundreds of thousands of unpatched servers were targeted by various cybercriminal groups and state-sponsored actors. The European Banking Authority was among the victims of these widespread attacks on Exchange infrastructure.

Background and Current Status

Even if an individual provides information about Zhang Yu’s whereabouts, his legal fate remains uncertain. He is believed to remain in China, a nation that typically refuses to extradite its citizens, particularly those accused of spying for the state on behalf of adversaries. Security firm SentinelOne noted that Shanghai Firetech has filed multiple software patents related to extracting data from computers, suggesting a technical infrastructure supporting these activities.

Xu Zewei, Zhang’s co-accused, is already in US custody. Xu was arrested at Milan airport in July 2025 and extradited to the United States in April of this year. He has pleaded not guilty to the charges. Xu claims he was in Italy on holiday with his wife and argues that law enforcement detained the wrong person. His case highlights the potential for US authorities to prosecute individuals linked to these campaigns when they travel outside China.

What should you do?

Organizations should treat this development as a reminder that state-sponsored actors remain active and motivated. While the bounty focuses on individual accountability, the underlying threat of targeted espionage persists. Security teams must ensure their defenses are robust against advanced persistent threats that may use similar tradecraft.

What to do and how to stay safe: Hafnium

• Monitor official government alerts for new indicators of compromise related to Hafnium or Silk Typhoon activity.
• Verify that all Microsoft Exchange Server systems are patched against known vulnerabilities to prevent unauthorized access.
• Implement strict access controls and multi-factor authentication for email accounts containing sensitive research or personal data.
• Review logs for unusual data exfiltration patterns, especially from accounts belonging to researchers or university staff.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is the US State Department looking for?

The US is seeking Zhang Yu, a 44-year-old director at Shanghai Firetech, for his alleged role in the Hafnium hacking group.

What crimes is Zhang Yu accused of?

He is charged with malicious cyber activity, including stealing COVID-19 vaccine research and exploiting Microsoft Exchange Server flaws.

Is there a fix for the Exchange Server vulnerabilities mentioned?

The source material notes that other groups targeted unpatched servers after flaws became public, implying patches were eventually available, but does not confirm current patch status.