US Offers $10 Million Reward for Info on HAFNIUM Hacker Zhang Yu

The U.S. State Department has announced a reward of up to $10 million for information that leads to the identification or location of Zhang Yu, a Chinese national charged in connection with the HAFNIUM cyberattacks. This development marks a significant escalation in the diplomatic and legal efforts to hold actors accountable for the 2021 breach of Microsoft Exchange Server infrastructure.

According to NTD News, which cited a notice from the State Department, the reward is specifically for information leading to Zhang Yu’s identification or location. Zhang Yu faces charges in the United States related to the coordinated intrusion campaign known as HAFNIUM. The attacks targeted Microsoft Exchange Server instances globally in 2021, allowing threat actors to bypass authentication and deploy web shells. The State Department’s reward program is part of the broader U.S. strategy to combat state-sponsored cybercrime by offering financial incentives for actionable intelligence.

Context and Background

The HAFNIUM campaign involved sophisticated exploitation of vulnerabilities in Microsoft Exchange Server software. The threat actors, widely attributed to Chinese state-sponsored groups, used these exploits to gain unauthorized access to email accounts, calendars, and contacts of numerous organizations worldwide. The U.S. government has previously indicted several individuals associated with these groups, including Zhang Yu, accusing them of conspiracy to commit computer fraud and abuse.

The offering of a $10 million reward underscores the severity with which the U.S. government views these intrusions. While previous indictments have served as legal tools, the financial reward aims to generate tips from sources that might not otherwise come forward. The notice cited by NTD News confirms that the State Department is actively seeking this specific information, indicating that Zhang Yu’s current location or identity details remain elusive to U.S. authorities. This move aligns with past precedents where the U.S. has offered substantial rewards for information on individuals linked to significant cyber incidents, such as those involving ransomware groups or espionage operations.

Who Is Affected

The direct impact of this announcement falls on Zhang Yu and any individuals or entities that may have information regarding his whereabouts or activities. For the broader cybersecurity community, the announcement serves as a reminder of the ongoing legal and diplomatic consequences for state-sponsored hacking. Organizations that were victims of the HAFNIUM attacks in 2021 may also view this as a step toward accountability, although the reward does not directly compensate for past damages. The focus remains on locating the charged individual rather than addressing the technical aftermath of the breach.

What should you do?

Security professionals should monitor official State Department announcements and reputable news outlets for updates on this case. While the reward is targeted at specific individuals, the underlying vulnerabilities exploited in the HAFNIUM campaign remain a relevant concern for any organization still running unpatched legacy systems. Ensuring that all software, particularly email servers, is up to date with the latest security patches is a fundamental defense against known exploits. Additionally, organizations should review their access logs for any signs of unauthorized activity, as threat actors may attempt to leverage previously compromised credentials or undetected backdoors.

What to do and how to stay safe: Microsoft Exchange Server

• Verify that all Microsoft Exchange Server instances are updated with the latest security patches provided by the vendor.
• Review access logs and audit trails for any suspicious activity or unauthorized access attempts that may indicate residual compromise.
• Monitor official communications from the U.S. State Department and cybersecurity agencies for further developments regarding Zhang Yu and related threat actors.
• Ensure that multi-factor authentication is enforced for all administrative and user accounts to reduce the risk of credential-based attacks.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much is the reward for information on Zhang Yu?

The U.S. State Department is offering up to $10 million for information leading to his identification or location.

What attacks is Zhang Yu charged with?

Zhang Yu is charged in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM.

Who reported the reward announcement?

NTD News reported the reward, citing a notice from the U.S. State Department.