The US government continues to combat cyberattacks on critical infrastructure related to the Chinese Communist Party. On Wednesday, October 7, the Federal Bureau of Investigation (FBI) forwarded the State Department’s announcement of a multimillion-dollar reward for the Chinese hacker Zhang Yu, who was instructed by the Shanghai State Security Bureau to unauthorizedly infiltrate COVID-19-related research conducted by American universities and scientists in an attempt to steal information.
The State Department’s “Rewards for Justice” program released a press release announcing a maximum reward of $10 million to gather information that helps confirm or locate the identity and whereabouts of the Chinese hacker Zhang Yu (Zhang Yu).
The press release stated that Zhang Yu is a Chinese citizen and a director of Shanghai Firetech Information Science and Technology Company, Ltd., operating under the instructions of the Ministry of State Security of the People’s Republic of China (PRC) and the Shanghai State Security Bureau (SSSB) National Security Office. MSS and SSSB are Chinese (CCP) intelligence agencies responsible for domestic counter-espionage, non-military foreign intelligence operations, and political and domestic security matters.
Since early 2020, Zhang Yu and his accomplice Xu Zewei (Xu Zewei, then general manager of Shanghai Shiyan Network Co., Ltd.), unauthorizedly accessed COVID-19 research data conducted by American universities and top immunologists and virologists, attempting to steal sensitive information.
The following year, Zhang Yu and Xu Zewei exploited computer system vulnerabilities in machines running Microsoft Exchange Server, as part of the “HAFNIUM” large-scale invasion operation, which resulted in thousands of computers globally being compromised. Victims included a university and a law firm in the United States.
Xu Zewei was arrested at Malpensa Airport in Milan on July 3, 2025, and extradited to the United States in April 2026, facing nine charges. Zhang Yu, however, remains at large.
The press release indicates that such individuals act under the directive and control of foreign governments, violating the Computer Fraud and Abuse Act, and engaging in malicious cyber activities against critical US infrastructure.
The State Department’s “Rewards for Justice” program states that China (CCP) utilizes its extensive network of private enterprises and contractors for hacking attacks and information theft to obscure the involvement of the Chinese government.
The “Rewards for Justice” program is a national security and counter-terrorism reward program established by the US State Department and managed by the Bureau of Diplomatic Security. Its core mission is to provide monetary rewards to informants providing effective leads, protecting the lives of American citizens, combating terrorism, and safeguarding US national security.
Since 1984, the program has awarded over $250 million to more than 125 individuals worldwide.