According to the State Department’s notice, the State Department’s Rewards for Justice program is offering up to $10 million for information that leads to the identification or location of Zhang Yu, a Chinese national charged in the United States over the HAFNIUM Microsoft Exchange campaign. According to the State Department’s notice, the notice was reported on Oct. 7, 2026.
According to The Hacker News, the reward is part of an ongoing Rewards for Justice program that pays for tips on anyone who, working for a foreign government, attacks U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. According to The Hacker News, the program has used the same wording and amount since January 2025, meaning the Zhang notice does not create a new offer but uses the existing one.
Who Zhang is and what he is charged with
According to The Hacker News, US authorities say Zhang is a director at Shanghai Firetech Information Science and Technology and allege he worked for the Shanghai State Security Bureau, which is part of China’s Ministry of State Security. According to The Hacker News, the allegations have not been proven in court.
Xu in custody, Zhang not
According to The Hacker News, Zhang and co-defendant Xu Zewei face nine counts in a Houston federal court. According to The Hacker News, authorities unsealed the indictment in July 2025, while according to The Record, one source dates it to November 2023. According to The Hacker News, the counts cover intrusions from February 2020 to June 2021, and Zhang remains at large.
How the reward program works
According to The Hacker News, Rewards for Justice reports paying out over $250 million to more than 125 individuals since its start in 1984. According to The Hacker News, Security Affairs, The Cyber Express, and The Epoch Times, tipsters can submit information through a Tor-based line, which routes traffic through an anonymizing network.
According to The Hacker News, reports differ on the terms. According to The Hacker News, most describe payment for identifying or locating Zhang, and the announcement text quoted by two outlets matches that. According to The Hacker News, one outlet calls it a reward for an arrest, which the other reports do not support. According to The Hacker News, the alleged victims are two universities in Texas and a global law firm with a Washington, D.C. office.
According to The Hacker News, US authorities say China uses private companies and contractors to hide the government’s role in cyber operations, and an FBI cyber official said Xu is one of many such contractors. According to The Hacker News, the offer predates this case (same wording and amount in use since January 2025) and authorities extradited Xu to the US in April 2026. According to The Hacker News, an FBI cyber official said Xu is one of many such contractors and that others face the same risk.
Join the discussion