US Offers $10M Bounty for Chinese Hacker Tied to 2021 HAFNIUM Microsoft Exchange Attacks

The U.S. State Department’s Rewards for Justice program announced a $10M bounty for information leading to the identification or location of Zhang Yu, an alleged Chinese intelligence operative. Zhang is facing a nine-count federal indictment in Houston for his alleged role in orchestrating the 2021 HAFNIUM cyber campaign, which exploited zero-day flaws in Microsoft $MSFT Exchange Server. The FBI assesses that the HAFNIUM operation compromised more than 12,700 U.S. organizations, originally targeting universities testing COVID-19 vaccines before expanding into a broader dragnet. Prosecutors allege Zhang operated as a director at Shanghai Firetech Information Science and Technology, functioning as a private contractor to mask cyber operations directed by China's Ministry of State Security. His co-defendant, Xu Zewei, was apprehended in Milan in July 2025 and formally extradited to the United States in April 2026 to face related charges. "Xu is one of many contractors the Chinese government uses to obscure its hand in cyber operations, and others who do the same face the same risk." — Brett Leatherman