Threats · 5h ago
The U.S. State Department has offered up to $10 million for information on Zhang Yu, the Chinese national accused of taking part in the HAFNIUM campaign against Microsoft Exchange Server. The reward comes after Xu Zewei’s extradition from Italy and the unsealed indictment that charged both men.
The case is no longer just about the Exchange intrusions themselves. U.S. authorities say Zhang and Xu worked through Shanghai-linked companies and the Shanghai State Security Bureau, so the new reward turns attribution into a live pressure campaign against an alleged operator network, not a fresh flaw in Exchange.
For organizations that tracked HAFNIUM because of the thefts it enabled, the lasting point is that the underlying exposure is unchanged while the law-enforcement posture around the actors has hardened. The reporting leaves the same open question it has for years: whether naming, charging, extradition, and bounty money will disrupt the network behind the campaign or mainly raise the personal risk for the people accused of running it.
3 sources covering this story
US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
Zhang Yu was charged alongside Xu Zewei, who was extradited from Italy to the US in April 2026.
U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
offers up to $10 million for information that identifies or locates Zhang Yu, charged over the HAFNIUM Exchange hacks.
The Record from Recorded Future
US posts $10 million reward for accused Chinese ‘Hafnium’ hacker
officials say Zhang Yu was a prominent figure in the Hafnium campaign, which saw hackers breach thousands of computers and steal troves of documents.
Part of the PlainSec briefing for 2026-10-08