Threat reportAPTTL-2026-3012
US posts $10M Rewards for Justice bounty for accused Hafnium hacker Zhang Yu (MSS-directed intrusion campaign)
US posts $10M Rewards for Justice bounty for accused Hafnium (TL-2026-3012), also tracked as HAFNIUM campaign, is a medium-severity advanced persistent threat campaign, first published 2026-10-07. It is attributed to HAFNIUM - G0125 (China) with high confidence, affects Microsoft Exchange Server, references 4 CVEs (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858), maps to 7 MITRE ATT&CK techniques (T1003.001, T1003.003, T1059.001), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 1HAFNIUM - G0125
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-3012
- Threat ID
- TL-2026-3012
- Also known as
- HAFNIUM campaign, Shanghai Firetech, Shanghai Powerock
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- HAFNIUM - G0125
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- education, health, legal, defense, government administration, think tanks, ngo
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in US posts $10M Rewards for Justice bounty for accused Hafnium
Malware and tooling: PowerCat, 7-Zip, China Chopper, Nishang, PowerCat, ProcDump
How US posts $10M Rewards for Justice bounty for accused Hafnium works
The US State Department's Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a Chinese national and director of Shanghai Firetech Information Science and Technology, accused of leading the Hafnium campaign at the direction of China's MSS and Shanghai State Security Bureau. A nine-count indictment covers intrusions between February 2020 and June 2021 that targeted over 60,000 US entities and victimized more than 12,700.
On 2026-10-07 the US State Department announced a Rewards for Justice offer of up to $10 million for information on Zhang Yu (reported age 44), a Chinese national and director of Shanghai Firetech Information Science and Technology. He is accused of leading the HAFNIUM (Microsoft: Silk Typhoon) hacking campaign at the behest of China's Ministry of State Security (MSS) and its Shanghai State Security Bureau (SSSB). Zhang remains at large. FBI Assistant Director Brett Leatherman said that through HAFNIUM the CCP targeted over 60,000 US entities and successfully victimized more than 12,700.
The nine-count indictment, prosecuted in the Southern District of Texas, covers computer intrusions between February 2020 and June 2021, the height of the COVID-19 pandemic. Charges reported against the co-defendant include wire fraud, conspiracy to damage and obtain information from protected computers through unauthorized access, and aggravated identity theft. Victims included US research universities (at least one in the Southern District of Texas), immunologists and virologists whose COVID-19 vaccine, treatment and testing research was stolen, and law firms; a global law firm with Washington offices was reportedly targeted for information on US policymakers. Reporting also lists defense contractors and policy think tanks among HAFNIUM targets.
Co-defendant Xu Zewei (34), employed by Shanghai Powerock Network Co. Ltd., was arrested in Milan in July 2025 on a US warrant, extradited from Italy, and made his first appearance in federal court in Houston on 2026-04-27. Prosecutors describe Powerock and Shanghai Firetech as private 'enabling' companies used to conceal MSS/SSSB direction. SentinelLabs reported that the July 2025 indictment expanded known Hafnium membership to at least four individuals across three companies, a tiered contracting structure under direct SSSB tasking, and found at least 10 Shanghai Firetech patents for forensics tooling with offensive applications (Apple device evidence collection, router traffic collection, remote automated evidence collection).
The source article reports no CVEs, malware or IOCs. The technical context below comes from the 2021 public HAFNIUM reporting by Microsoft and CISA/FBI, which the indictment period overlaps: chained Microsoft Exchange Server zero-days (CVE-2021-26855 SSRF, CVE-2021-26857 insecure deserialization in Unified Messaging, CVE-2021-26858 and CVE-2021-27065 post-authentication arbitrary file write), ASPX web shells (China Chopper variants) in Exchange and IIS directories, LSASS dumping with Procdump, Nishang and PowerCat reverse shells, 7-Zip staging, and mailbox export via Exchange PowerShell snap-ins. Microsoft attributed the exploitation to HAFNIUM in March 2021 and the US government attributed it to the PRC MSS on 2021-07-19. The IOCs here are historical 2021 indicators and should be used for retrospective hunting rather than as current infrastructure.
MITRE ATT&CK techniques used in TL-2026-3012
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS
Execution
T1059.001 Command and Scripting Interpreter: PowerShell
Collection
T1114.002 Email Collection: Remote Email Collection; T1560.001 Archive Collected Data: Archive via Utility
Initial Access
T1190 Exploit Public-Facing Application
Persistence
Affected products and versions in US posts $10M Rewards for Justice bounty for accused Hafnium
- Microsoft — Exchange Server
Vulnerable versions: 2013; 2016; 2019 (pre-March 2021 security updates)
Fixed in: March 2021 security updates; April 2021 updates
Remediation for US posts $10M Rewards for Justice bounty for accused Hafnium
Patches
- Apply Microsoft March 2021 Exchange security updates for CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065
Immediate actions
- Retrospectively hunt Exchange servers for ASPX web shells in aspnet_client, FrontEnd\HttpProxy\owa\auth and ecp\auth directories
- Check historical proxy/firewall logs for the 2021 HAFNIUM IP indicators
- Review for LSASS dumps via Procdump and Exchange mailbox export activity (New-MailboxExportRequest) from the 2021 window
Workarounds
- Run Microsoft Exchange On-Premises Mitigation Tool / IOC scanning script where patching is delayed
Longer-term hardening
- Keep on-premises Exchange fully patched and minimize internet exposure of OWA/ECP
- Monitor Exchange worker process (w3wp.exe, UMWorkerProcess.exe) child-process creation
- Harden research and law-firm environments holding sensitive pre-publication data
CVEs associated with US posts $10M Rewards for Justice bounty for accused Hafnium
CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065
Timeline of US posts $10M Rewards for Justice bounty for accused Hafnium
- Start of the intrusion period charged in the nine-count indictment (February 2020).
- Exploitation of Exchange Server zero-days observed from early January 2021 onward.
- Microsoft discloses HAFNIUM exploitation of four Exchange zero-days and releases patches.
- FBI and CISA issue joint advisory on Exchange Server compromise.
- End of the intrusion period charged in the indictment (June 2021).
- US government attributes the Exchange exploitation to the PRC Ministry of State Security.
- Co-defendant Xu Zewei arrested in Milan on a US warrant; indictment of Xu Zewei and Zhang Yu made public in July 2025.
- Xu Zewei extradited from Italy and appears in federal court in Houston, Texas.
- State Department Rewards for Justice offers up to $10 million for information on Zhang Yu, who remains at large.
Sources cited for US posts $10M Rewards for Justice bounty for accused Hafnium
- US posts $10 million reward for accused Chinese 'Hafnium' hacker
- Chinese National Extradited Over Silk Typhoon Campaign (CyberScoop)
- Chinese Silk Typhoon hacker extradited (The Hacker News)
- Chinese state-sponsored hacker arrested on US warrant (DOJ USAO SDTX)
- China's Covert Capabilities: Silk Spun From Hafnium (SentinelLabs)
- HAFNIUM targeting Exchange Servers with 0-day exploits (Microsoft)
- CISA/FBI Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities
- Chinese hacker extradited from Italy (The Record)
- Chinese firms linked to Silk Typhoon (The Hacker News)
Detection coverage for TL-2026-3012
As of 2026-10-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3012 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.