Reported by 4 outlets
U.S. Offers $10 Million Reward for Chinese Hacker Behind Alleged COVID-19 Research Cyberattacks
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.02 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Desk analysis
The State Department's Rewards for Justice program is offering up to $10 million for information on Zhang Yu, the Chinese national charged in a nine-count indictment, unsealed in July 2025, with stealing American COVID-19 research and taking part in the Hafnium campaign against Microsoft Exchange servers. RFJ names Zhang a director of Shanghai Firetech Information Science and Technology working for the Shanghai State Security Bureau under the Ministry of State Security. His codefendant Xu Zewei, then general manager at Shanghai Powerock Network, was arrested in Milan on July 3, 2025, extradited in April 2026 and has appeared in federal court in Houston; Zhang remains at large. The indictment spans February 2020 through June 2021, from university vaccine research to the Exchange intrusions Microsoft disclosed in March 2021 and now tracks as Silk Typhoon.
The reward adds no new intrusion; it converts a fifteen-month-old indictment into an active manhunt and signals the government still lacks location intelligence on Zhang. The part the event list understates is structural: both indicted men ran commercial firms, Firetech and Powerock, so Hafnium was contractor labor purchased by SSSB rather than a uniformed unit, and SentinelLabs' July 2025 review of Firetech's patent filings showed that payroll extending into surveillance tooling with no Hafnium connection. That framing matters for exposure math. Thousands of computers worldwide were compromised, victims included a US university that lost vaccine research and a US law firm, and a contractor model means the same hired hands can be re-tasked against health research or legal targets without a new state directive ever becoming visible.
Defenders should confirm every remaining Exchange server carries the patch cycle Microsoft shipped in March 2021 for Hafnium, since unpatched survivors of that window are exactly the population this indictment describes. Sweep 2020 to 2021 era email and perimeter telemetry for activity inside the indicted February 2020 to June 2021 window, and treat Shanghai Firetech and Shanghai Powerock as attributed contractor entities worth tagging in threat-intel platforms and watching for in supply and procurement chains. Organizations doing health research or legal work fit the documented victim profile and should weight those hunts accordingly. Anyone with actionable information on Zhang's location or associates can route it through Rewards for Justice, which is the entire point of the bounty.
Two developments would change the assessment. Treasury sanctions or further designations against Shanghai Firetech and affiliated contractors would add names and infrastructure to a map currently drawn from two indictments and a patent review. Xu Zewei's Houston proceedings matter just as much: trial evidence could publish tradecraft not yet public, and a conviction would set the prosecutorial template for pursuing Zhang. Beijing's reaction is the political tell, since the Foreign Ministry already criticized Italy over the April extradition, and prior RFJ bounties on MSS and PLA personnel have drawn reciprocal measures.
Timeline
-
original reporting
U.S. Offers $10 Million Reward for Chinese Hacker Behind Alleged COVID-19 Research Cyberattacks
gbhackers.com · 5d ago · October 8th, 2026
The U.S. Department of State is offering a reward of up to $10 million for information regarding Zhang Yu, a Chinese national accused of participating in cyberattacks that targeted American COVID-19 research. This initiative, part of the Rewards for Justice program, seeks information about Zhang, his associates, and their malicious cyber activities. Zhang is alleged […] The post U.S. Offers $10 Million Reward for Chinese Hacker Behind Alleged COVID-19 Research Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from therecord.media
Chinese national arrested in Milan after US issues arrest warrant for Hafnium attacks
therecord.media · 462d ago · July 8th, 2025
Italian police arrested Xu Zewei, a 33-year-old from Shanghai, at Milan's airport on July 3, 2025, on a US warrant charging wire fraud, aggravated identity theft and unauthorized access to protected computers. The Justice Department unsealed a nine-count indictment accusing Xu and co-defendant Zhang Yu of computer intrusions from February 2020 to June 2021, including the Hafnium campaign that compromised thousands of computers worldwide. Prosecutors said Xu acted at the behest of China's Ministry of State Security and the Shanghai State Security Bureau, and that the team targeted a Texas university in 2020 to obtain COVID-19 vaccine research.
-
update from therecord.media
Patents by Silk Typhoon-linked company shed light on Beijing's offensive hacking capabilities
therecord.media · 440d ago · July 30th, 2025
SentinelLabs researcher Dakota Cary mapped Justice Department indictments to Shanghai Firetech, a company the DOJ said works on behalf of the Shanghai State Security Bureau and took part in Silk Typhoon attacks while previously being identified in the 2021 Hafnium campaign. The review found patents for offensive tooling, including home-appliance analysis and evidence collection software that could support surveillance of individuals abroad. Cary concluded the company serves offensive missions beyond the Hafnium cluster.
-
update from therecord.media
Italy extradites alleged Chinese state hacker to US
therecord.media · 169d ago · April 27th, 2026
Xu Zewei was extradited from Milan to the United States in late April 2026 and held at the Houston Federal Detention Center, his lawyer confirmed. Xu has denied involvement in Chinese government hacking, claiming mistaken identity, and was on vacation in Milan when arrested in July 2025. China's Foreign Ministry spokesman Lin Jian criticized the Italian government's decision at a press conference the following Monday.
-
update from therecord.media
US posts $10 million reward for accused Chinese 'Hafnium' hacker
therecord.media · 6d ago · October 7th, 2026
The announcement says Zhang violated the Computer Fraud and Abuse Act in attacks on at least one university and a law firm, alongside Xu Zewei, who was extradited to the US in April. Zhang remains at large.
-
update from securityweek.com
US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
securityweek.com · 5d ago · October 8th, 2026
According to RFJ, Zhang is a director at Shanghai Firetech Information Science and Technology Company . He allegedly worked on behalf of the Shanghai State Security Bureau (SSSB), part of China’s Ministry of State Security (MSS). Xu has since appeared in federal court in Houston, while Zhang remains at large. “Starting in early 2020, Zhang and his partner Xu Zewei, then a general manager at Shanghai Powerock Network Co. Ltd., gained unauthorized access to COVID-19 research conducted by US-based universities and leading immunologists and virologists to steal sensitive information,” RFJ said. The following year, the two allegedly exploited vulnerabilities in Microsoft Exchange Server as part of Hafnium. Microsoft disclosed the Hafnium attacks in March 2021 and now tracks the threat actor as Silk Typho
-
mentioned by insicurezzadigitale.com
US offers $10 million reward for Zhang Yu, the Shanghai Firetech contractor behind HAFNIUM
insicurezzadigitale.com · 5d ago · October 8th, 2026