Key points
- The US State Department is offering up to $10 million for information leading to the whereabouts of Zhang Yu.
- Zhang Yu is accused of being a key figure in the Hafnium hacking group, which breached Microsoft Exchange systems.
- Authorities allege Zhang and Xu Zewei stole sensitive data, including COVID-19 vaccine research, from US institutions.
The US State Department announced a bounty of up to $10 million for information regarding Zhang Yu, a 44-year-old Chinese national. According to the Rewards for Justice website, Zhang is accused of serving as a key figure in the state-sponsored hacking group known as Hafnium, also referred to as Silk Typhoon.
In plain English
Zhang Yu is alleged to have directed malicious cyber activity against US computer systems between February 2020 and June 2021. He is charged alongside Xu Zewei, a 34-year-old national. The pair reportedly stole data from email accounts belonging to immunologists, virologists, and US universities. This data included research on COVID-19 vaccines, allegedly at the behest of the Chinese government.
The background
Hafnium is widely believed to have exploited zero-day vulnerabilities to breach Microsoft Exchange Server systems in early 2021. Once these flaws became public, other cybercriminal groups and state-sponsored hackers targeted hundreds of thousands of unpatched servers. Victims of this broader targeting included the European Banking Authority, according to the report.
US authorities claim that China utilizes private companies, such as Shanghai Firetech Information Science and Technology, to conduct espionage while obscuring government involvement. Zhang Yu is listed as a director at Shanghai Firetech and works under the Shanghai State Security Bureau. Security firm SentinelOne noted that Shanghai Firetech filed multiple software patents related to extracting data from computers.
What changes now
Even if Zhang Yu’s location is disclosed, legal proceedings face significant hurdles. He is believed to be in China, which does not extradite its citizens, particularly those alleged to have spied on adversaries. In contrast, Xu Zewei was arrested at Milan airport in July 2025 and extradited to the United States in April of this year. Xu has pleaded not guilty, claiming he was detained in error while on holiday.
Background: Zero-day vulnerabilities
You expose systems to zero-day exploits by ignoring input validation, skipping configuration hardening, and relying on perimeter defenses. Fix these by enforcing least privilege, segmenting networks, and validating all external data streams.
Read the full guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
What to do and how to stay safe: Hafnium
- Monitor official government channels for updates on high-value bounties and associated threat actor profiles.
- Review access logs for Microsoft Exchange Server systems for signs of unauthorized administrative access.
- Ensure all email servers are patched against known vulnerabilities, even those that have been public for some time.
- Verify the integrity of sensitive research data stored in email accounts and cloud storage systems.
Step-by-step guide: Microsoft Exchange Vulnerability Warning Signs and Response Steps
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is the subject of the $10 million bounty?
The bounty is for Zhang Yu, a 44-year-old Chinese national accused of being a key figure in the Hafnium hacking group.
What crimes are Zhang Yu and Xu Zewei accused of?
They are charged with malicious cyber activity, including stealing data such as COVID-19 vaccine research from US institutions.
Is Zhang Yu currently in custody?
No, Zhang Yu is believed to be in China, which will not extradite its citizens, while Xu Zewei was extradited to the US.
