The U.S. State Department has offered up to $10 million for information on Zhang Yu, the Chinese national accused of taking part in the HAFNIUM campaign against Microsoft Exchange Server. The reward comes after Xu Zewei’s extradition from Italy and the unsealed indictment that charged both men.
The case is no longer just about the Exchange intrusions themselves. U.S. authorities say Zhang and Xu worked through Shanghai-linked companies and the Shanghai State Security Bureau, so the new reward turns attribution into a live pressure campaign against an alleged operator network, not a fresh flaw in Exchange.
For organizations that tracked HAFNIUM because of the thefts it enabled, the lasting point is that the underlying exposure is unchanged while the law-enforcement posture around the actors has hardened. The reporting leaves the same open question it has for years: whether naming, charging, extradition, and bounty money will disrupt the network behind the campaign or mainly raise the personal risk for the people accused of running it.