The US State Department has announced a $10 million reward for information leading to the arrest of Zhang Yu, a Chinese national accused of being a key figure in the Hafnium hacking campaign. Zhang, who serves as director of Shanghai Firetech Information Science and Technology, is alleged to have acted on behalf of Chinese intelligence services in a series of computer intrusions.
According to a nine-count indictment, Zhang and co-defendant Xu Zewei conducted cyberattacks between February 2020 and June 2021, including the HAFNIUM campaign that compromised thousands of computers worldwide. The stolen data reportedly included COVID-19 research from US-based universities, immunologists, and virologists. Xu was arrested by Italian authorities in Milan in July 2025 and later extradited to the US.
The Justice Department alleges the two men reported to supervisors at the Shanghai State Security Bureau. FBI cyber division assistant director Brett Leatherman said HAFNIUM targeted over 60,000 US entities and successfully victimized more than 12,700. Zhang remains at large.