US offers $10M Rewards for Justice bounty for Hafnium (Silk Typhoon) suspect Zhang Yu over Exchange Server attacks
The US State Department is offering up to US $10 million through Rewards for Justice for information on Zhang Yu, 44, a Chinese national accused of being a key figure in the state-sponsored group Hafnium (also tracked as Silk Typhoon). Zhang is described as a director at Shanghai Firetech Information Science and Technology, working under the direction of the Shanghai State Security Bureau, part of China's Ministry of State Security. He is charged alongside Xu Zewei, 34, with malicious cyber activity against US systems between February 2020 and June 2021. Xu was arrested at Milan airport in July 2025 and extradited to the US in April 2026. He has pleaded not guilty, and China's Foreign Ministry opposed the extradition. Zhang is believed to be in China, which does not extradite its citizens, so arrest is unlikely.
Technical Details
- From early 2020, Zhang and Xu allegedly stole data, including COVID-19 vaccine research, from the email accounts of immunologists, virologists and US universities.
- In early 2021 the pair allegedly exploited Microsoft Exchange Server vulnerabilities (zero-days) to steal further information. After the flaws became public, other criminal and state-sponsored groups reportedly targeted hundreds of thousands of unpatched servers. Victims included the European Banking Authority.
- US authorities say China uses private contractors such as Shanghai Firetech and Xu's Shanghai Powerock Network to conduct espionage while obscuring government involvement.
- Per SentinelOne, Shanghai Firetech filed multiple software patents related to extracting data from computers.
The article names no specific CVEs or IOCs.
Linha do tempo
-
US offers $10M Rewards for Justice bounty for Hafnium (Silk Typhoon) suspect Zhang Yu over Exchange Server attacks
ler a análise desta fonte ocultar
The US State Department is offering up to US $10 million through Rewards for Justice for information on Zhang Yu, 44, a Chinese national accused of being a key figure in the state-sponsored group Hafnium (also tracked as Silk Typhoon). Zhang is described as a director at Shanghai Firetech Information Science and Technology, working under the direction of the Shanghai State Security Bureau, part of China's Ministry of State Security. He is charged alongside Xu Zewei, 34, with malicious cyber activity against US systems between February 2020 and June 2021. Xu was arrested at Milan airport in July 2025 and extradited to the US in April 2026. He has pleaded not guilty, and China's Foreign Ministry opposed the extradition. Zhang is believed to be in China, which does not extradite its citizens, so arrest is unlikely.
Technical Details
- From early 2020, Zhang and Xu allegedly stole data, including COVID-19 vaccine research, from the email accounts of immunologists, virologists and US universities.
- In early 2021 the pair allegedly exploited Microsoft Exchange Server vulnerabilities (zero-days) to steal further information. After the flaws became public, other criminal and state-sponsored groups reportedly targeted hundreds of thousands of unpatched servers. Victims included the European Banking Authority.
- US authorities say China uses private contractors such as Shanghai Firetech and Xu's Shanghai Powerock Network to conduct espionage while obscuring government involvement.
- Per SentinelOne, Shanghai Firetech filed multiple software patents related to extracting data from computers.
The article names no specific CVEs or IOCs.