The U.S. State Department has announced a reward of up to $10 million for information leading to the arrest or conviction of Zhang Yu, a Chinese national accused of involvement in the Hafnium hacking campaign. Zhang is alleged to be a central figure in a series of cyberattacks that compromised thousands of computers globally and stole sensitive data, including COVID-19 research.
U.S. officials claim Zhang, identified as the director of Shanghai Firetech Information Science and Technology, operated on behalf of the Chinese government. He is accused of working with another Chinese official, Xu Zewei, in operations that targeted U.S. universities, immunologists, and virologists to steal research related to COVID-19. The State Department states that Zhang violated the Computer Fraud and Abuse Act through these cyberattacks, which included at least one university and a law firm among their targets.
A nine-count indictment unsealed last year by the Justice Department implicated both Zhang and Xu in "computer intrusions between February 2020 and June 2021," which encompassed the "indiscriminate HAFNIUM computer intrusion campaign." This campaign reportedly compromised thousands of computers worldwide, including in the United States. Prosecutors allege that the men conducted these hacks at the direction of the Ministry of State Security (MSS) and Shanghai State Security Bureau (SSSB) intelligence services, reporting back to supervising officers at the SSSB.
One specific instance cited in the indictment involves Xu confirming that he "had compromised the network of a research university located in the Southern District of Texas." An assistant director of the FBI’s cyber division stated last year that the Hafnium campaign targeted over 60,000 U.S. entities, successfully victimizing more than 12,700 to steal sensitive information.
While Zhang Yu remains at large, Xu Zewei was arrested in July 2025 by Italian authorities during a vacation in Milan. Xu was subsequently extradited to the U.S. in April of the following year.
