The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM.

The reward is for information leading to his identification or location, the news outlet NTD reported this week, citing a notice from the department's Rewards for Justice program.

Zhang remains at large, U.S. authorities say, meaning he has not been arrested. The charges against him have not been tested in court.

Rewards for Justice is the State Department's national security rewards program. It says it has paid more than $250 million to over 125 people since 1984.

Zhang is wanted for his alleged role in "malicious cyber activities against U.S. critical infrastructure," NTD quoted the notice as saying.

The amount and that wording match an offer the program was already making in January 2025. That offer was for information on anyone who hacks U.S. critical infrastructure at the direction of a foreign government.

Zhang and a second man, Xu Zewei, are charged together in federal court in Houston. The indictment, the document that sets out the charges, has nine counts.

It dates from November 2023 and was made public in July 2025. Since then, the Justice Department has asked the public for information about Zhang's whereabouts.

Xu was arrested in Milan in July 2025 at the request of the United States, and Italy extradited him to the United States in April 2026.

Source link