Key facts
- The reward was publicized on October 7 (2026), and Zhang remains at large; the charges are allegations not yet tested in court.
- Zhang and Xu Zewei are charged in a nine-count indictment in federal court in Houston covering intrusions from February 2020 to June 2021. It was unsealed in July 2025.
- Prosecutors allege the pair first targeted US universities and researchers working on COVID-19 vaccines, treatments and testing in early 2020, then exploited Microsoft Exchange Server flaws in the Hafnium campaign.
- The FBI says Hafnium compromised more than 12,700 US organizations and targeted more than 60,000 US entities. These totals cover the whole campaign, not only Zhang and Xu.
The State Department’s Rewards for Justice (RFJ) program is offering up to $10 million for tips that identify or locate Zhang Yu, a Chinese national charged in the US over the Hafnium hacking campaign. The reward was publicized on Oct. 7, 2026. Zhang remains at large, and the charges are allegations that have not been tested in court.
The charges
Zhang and Xu Zewei are named in a nine-count indictment in federal court in Houston covering intrusions from February 2020 to June 2021, according to SecurityWeek and The Hacker News. The indictment was unsealed in July 2025.
SecurityWeek and The Record describe Zhang as a director at Shanghai Firetech Information Science and Technology and report that he is alleged to have worked for the Shanghai State Security Bureau, part of China’s Ministry of State Security (MSS). Several outlets give his age as 44. The reports carry no response from Zhang.
From COVID-19 research to Exchange servers
Prosecutors allege the pair first targeted US universities and researchers working on COVID-19 vaccines, treatments and testing in early 2020. They then allegedly exploited flaws in Microsoft Exchange Server, a widely used email and calendar system, in the campaign known as Hafnium, according to SecurityWeek and The Hacker News.
SecurityWeek and NTD report that Microsoft went public with the Exchange attacks on March 2, 2021, shipping patches for four unpatched vulnerabilities, including the one known as ProxyLogon. Such flaws are called zero-days because attackers exploit them before a fix exists. The FBI’s own tally, as relayed by The Record and The Hacker News, is that Hafnium compromised more than 12,700 US organizations and targeted more than 60,000. Those totals cover the whole campaign, not only the conduct charged against Zhang and Xu.
How the case fits the group's history
The actor has carried more than one name. Microsoft first used Hafnium and now tracks the same activity as Silk Typhoon, according to SecurityWeek and The Hacker News, so reports using either label describe the same campaign.
The attribution to the MSS came in July 2021, when the US and partner governments attributed the campaign to the Chinese ministry, as reported by SecurityWeek and NTD. The sources do not state a confidence level for that attribution. The 2025 and 2026 actions go a step further by naming individuals rather than a ministry.
The Justice Department’s position, as relayed by The Hacker News and NTD, is that Xu worked for Shanghai Powerock Network, one of many private “enabling” companies China uses to hack while hiding government involvement. The department’s account for Zhang, as reported by SecurityWeek and The Record, ties him to Firetech and the Shanghai State Security Bureau. Both are the government’s allegations, not findings.
The United States is committed to pursuing hackers who steal information from U.S. businesses and universities and threaten our cybersecurity
John A. Eisenberg, Assistant Attorney General for National Security, as quoted by NTD, NTD
The Xu extradition and the reward program
Italian police arrested Xu in Milan in July 2025 at US request, according to SecurityWeek and The Record. Italy extradited him to the US in April 2026, and he has appeared in federal court in Houston. Cyber Press gives a more specific date of April 25, 2026, which other outlets do not.
According to SecurityWeek and The Hacker News, the offer falls under an RFJ announcement in place since at least January 2025 for information on people who hack US critical infrastructure at a foreign government’s direction in violation of the Computer Fraud and Abuse Act. The alleged victims in this case include a US university and a law firm. RFJ says it has paid more than $250 million to over 125 people since 1984, per Security Affairs and The Hacker News.
Why it matters
The extradition and the reward together show US authorities pursuing individual contractors behind alleged Chinese state hacking, including the private-company layer the Justice Department says China uses for deniability. Xu is in US custody and answering the Houston indictment, while Zhang is reported to be at large with a bounty on information about him. Until Zhang is located or Xu’s case reaches a verdict, every allegation in the indictment remains unresolved.
Join the discussion