US Puts $10M Bounty on Alleged Hafnium Hacker Behind Exchange Breach

Last updated: October 12, 2026

If your organization relies on Microsoft Exchange, the long tail of a 2021 mega-attack is still shaping the threat you face today. The US State Department has posted a reward of up to US $10 million for information leading to a Chinese national accused of being a core operator inside Hafnium, the state-sponsored group tied to those Exchange exploits, according to bitdefender.com.

The post sits on the Rewards for Justice program and targets 44-year-old Zhang Yu, a director at Shanghai Firetech Information Science and Technology. He and the second defendant named in the case are facing federal charges for hacking activity aimed at US targets that ran through 2020 and into mid-2021. The case is not theoretical for IT teams: the original Exchange flaws helped trigger a wave of follow-on compromises that defenders are still cleaning up five years on, per the bounty listing and prior reporting.

What happened:

• US State Department offers up to $10 million for information on the whereabouts of Zhang Yu.
• Zhang is identified as a director at Shanghai Firetech and allegedly works under China's Ministry of State Security.
• He and co-defendant Xu Zewei face charges tied to cyber operations against US targets from February 2020 to June 2021.
• The indictment references theft of COVID-19 vaccine research from immunologists, virologists, and US universities.
• Hafnium, also called Silk Typhoon, is linked to exploitation of Microsoft Exchange Server zero-day vulnerabilities in early 2021.

What the indictment actually covers

The Rewards for Justice notice lays out a specific timeline. Beginning in 2020, Zhang and Xu allegedly began exfiltrating data tied to COVID-19 vaccine work, pulling material from mailboxes belonging to immunologists, virologists, and academic staff at US universities. The following year, the pair allegedly shifted to exploiting flaws in Microsoft Exchange Server to extract more information.

Once those Exchange vulnerabilities became public, other criminal and state-aligned groups piled in and targeted hundreds of thousands of unpatched servers. Victims reportedly included the European Banking Authority. That follow-on wave is the part most IT teams actually remember, because it is what turned a single group's operation into a global incident response exercise.

A second detail deserves attention. US authorities allege that China routes hacking work through private companies such as Shanghai Firetech and Xu's Shanghai Powerock Network. The point of that structure, prosecutors say, is to give the Ministry of State Security plausible distance from the intrusions. Security firm SentinelOne has noted that Shanghai Firetech filed software patents related to extracting data from computers, which the indictment references as relevant context.

Who should care beyond the named parties

The obvious audience is Exchange administrators. The less obvious one is anyone who built third-party integrations against Exchange in 2020 or 2021, since service principals, OAuth tokens, and EWS subscriptions minted back then often outlive the people who created them. Vendor risk teams should also pay attention: a company that appears in a US indictment as a front for state hacking is, by definition, a higher-risk counterparty for data-handling contracts, and that includes resellers, managed service providers, and any software vendor that lists Shanghai Firetech or Shanghai Powerock in its corporate history. Universities running hybrid Exchange for research labs fall into the same bucket, because the indictment specifically calls out academic targets.

Why this matters for Exchange defenders

The charges do not change today's firewall rules, but they do sharpen the threat model. State-linked groups did not just drop zero-days and walk away. They staged persistent access, then quietly pulled mailboxes and research data. That pattern repeats in current reporting on Chinese intrusions, which is why "patch and move on" is not enough.

The practical exposure for a mid-sized Exchange shop looks like this. A defender who only applied the March 2021 cumulative updates inherited a server that was already probed by automation within days of disclosure. Web shells such as "China Chopper" landed in IIS directories, persistent Exchange admin credentials leaked, and attackers pivoted into mailboxes and adjacent on-premise systems. Five years later, that often means stale service accounts, forgotten OAuth grants, and historical mailbox forwarding rules that nobody has reviewed.

Options compared for reducing residual risk

Most organizations have already moved past the original patching question. The choice is what to spend the next budget cycle on. Three options stack up clearly.

First, a paid EDR plus managed hunting tier. It bundles the continuous monitoring workload that catches the post-exploit behaviors Hafnium-style groups lean on: unusual Exchange admin calls, abnormal PowerShell on the Exchange server, and mailbox export patterns. Cost is higher, and you are trusting a vendor's playbook.

Second, free built-in tooling plus internal logging investment. Microsoft's own Defender for Cloud Apps, audit logging, and Exchange admin audit logs are capable if someone is actually reading them. Cost is low, but the labor cost is real and easy to underfund.

Third, full migration off on-premise Exchange to Microsoft 365 in a hardened configuration. That removes the class of IIS-based web shell entirely but creates a new dependency on Microsoft's detection pipeline and on your tenant's conditional access posture.

Our analysis

The interesting question is not the dollar figure. $10 million is a policy signal, not a price tag. Rewards for Justice bounties historically produce more tips on travel and identity than on capture, especially when the target sits in a country that does not extradite its own citizens. Zhang is believed to be in mainland China, which sharply limits the practical upside of the bounty itself. The more concrete effect is that Xu Zewei, the co-defendant, was arrested at Milan airport in July 2025 and extradited to the United States in April this year, per the report. Xu has pleaded not guilty, and China's Foreign Ministry has rejected the charges. Translation: foreign travel for anyone in this network is now a measurable personal risk, and that changes the calculus for future operations.

There is also a trade-off worth naming. Bounties create use, but they also confirm that the accused is valuable enough to price at eight figures. For defenders, that is useful intelligence. It tells you that the operational tradecraft tied to Exchange, mailbox pivots, and research theft is still considered worth protecting at the state level.

What to watch next

Watch to see whether any further Rewards for Justice entries name additional Shanghai Firetech or Shanghai Powerock staff, because the indictment describes an apparent pattern, not a one-off. Watch legal movement in Xu's case, since a guilty plea or a trial would generate documents that name tools, infrastructure, and timelines. And watch for any CVE tied to Exchange or hybrid Exchange components in the next Microsoft Patch Tuesday, because state groups rotate to new flaws once old ones are widely defended.

Bottom line: this bounty is a long-tail consequence of a 2021 mass-exploitation event, and it is a reminder to treat Exchange hygiene as an ongoing program, not a closed ticket.

Key takeaways

• Patch level alone does not close the 2021 Exchange exposure; review mailbox forwarding rules, admin audit logs, and service accounts that predate the 2021 cumulative updates.
• Treat any organization named in the indictment, including Shanghai Firetech and Shanghai Powerock, as relevant for the partners and suppliers you onboard.
• If you still run hybrid Exchange, assume that automation probed your IIS directories within days of disclosure, and hunt for it now, not later.