# US posts $10M Rewards for Justice bounty for accused Hafnium hacker Zhang Yu (MSS-directed intrusion campaign)

> The US State Department's Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a Chinese national and director of Shanghai Firetech Information Science and Technology, accused of leading the Hafnium campaign at the direction of China's MSS and Shanghai State Security Bureau. A nine-count indictment covers intrusions between February 2020 and June 2021 that targeted over 60,000 US entities and victimized more than 12,700.

- **Published:** 2026-10-07T00:00:00Z
- **Last reviewed:** 2026-10-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3012
- **ID:** TL-2026-3012
- **Severity:** MEDIUM
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** HAFNIUM - G0125 (China)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065

## Description

On 2026-10-07 the US State Department announced a Rewards for Justice offer of up to $10 million for information on Zhang Yu (reported age 44), a Chinese national and director of Shanghai Firetech Information Science and Technology. He is accused of leading the HAFNIUM (Microsoft: Silk Typhoon) hacking campaign at the behest of China's Ministry of State Security (MSS) and its Shanghai State Security Bureau (SSSB). Zhang remains at large. FBI Assistant Director Brett Leatherman said that through HAFNIUM the CCP targeted over 60,000 US entities and successfully victimized more than 12,700.

The nine-count indictment, prosecuted in the Southern District of Texas, covers computer intrusions between February 2020 and June 2021, the height of the COVID-19 pandemic. Charges reported against the co-defendant include wire fraud, conspiracy to damage and obtain information from protected computers through unauthorized access, and aggravated identity theft. Victims included US research universities (at least one in the Southern District of Texas), immunologists and virologists whose COVID-19 vaccine, treatment and testing research was stolen, and law firms; a global law firm with Washington offices was reportedly targeted for information on US policymakers. Reporting also lists defense contractors and policy think tanks among HAFNIUM targets.

Co-defendant Xu Zewei (34), employed by Shanghai Powerock Network Co. Ltd., was arrested in Milan in July 2025 on a US warrant, extradited from Italy, and made his first appearance in federal court in Houston on 2026-04-27. Prosecutors describe Powerock and Shanghai Firetech as private 'enabling' companies used to conceal MSS/SSSB direction. SentinelLabs reported that the July 2025 indictment expanded known Hafnium membership to at least four individuals across three companies, a tiered contracting structure under direct SSSB tasking, and found at least 10 Shanghai Firetech patents for forensics tooling with offensive applications (Apple device evidence collection, router traffic collection, remote automated evidence collection).

The source article reports no CVEs, malware or IOCs. The technical context below comes from the 2021 public HAFNIUM reporting by Microsoft and CISA/FBI, which the indictment period overlaps: chained Microsoft Exchange Server zero-days (CVE-2021-26855 SSRF, CVE-2021-26857 insecure deserialization in Unified Messaging, CVE-2021-26858 and CVE-2021-27065 post-authentication arbitrary file write), ASPX web shells (China Chopper variants) in Exchange and IIS directories, LSASS dumping with Procdump, Nishang and PowerCat reverse shells, 7-Zip staging, and mailbox export via Exchange PowerShell snap-ins. Microsoft attributed the exploitation to HAFNIUM in March 2021 and the US government attributed it to the PRC MSS on 2021-07-19. The IOCs here are historical 2021 indicators and should be used for retrospective hunting rather than as current infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1114.002 Email Collection: Remote Email Collection
- T1560.001 Archive Collected Data: Archive via Utility

## Sources

- [US posts $10 million reward for accused Chinese 'Hafnium' hacker](https://therecord.media/accused-hafnium-hacker-zhang-yu-10million-reward)
- [Chinese National Extradited Over Silk Typhoon Campaign (CyberScoop)](https://cyberscoop.com/xu-zewei-extradited-china-national-silk-typhoon-hafnium/)
- [Chinese Silk Typhoon hacker extradited (The Hacker News)](https://thehackernews.com/2026/04/chinese-silk-typhoon-hacker-extradited.html)
- [Chinese state-sponsored hacker arrested on US warrant (DOJ USAO SDTX)](https://www.justice.gov/usao-sdtx/pr/chinese-state-sponsored-hacker-arrested-us-warrant)
- [China's Covert Capabilities: Silk Spun From Hafnium (SentinelLabs)](https://www.sentinelone.com/labs/chinas-covert-capabilities-silk-spun-from-hafnium/)
- [HAFNIUM targeting Exchange Servers with 0-day exploits (Microsoft)](https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers/)
- [CISA/FBI Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a)
- [Chinese hacker extradited from Italy (The Record)](https://therecord.media/chinese-hacker-italy-extradited)
- [Chinese firms linked to Silk Typhoon (The Hacker News)](https://thehackernews.com/2025/07/chinese-firms-linked-to-silk-typhoon.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3012